Merge remote-tracking branch 'origin/stable/10' into develdevel

39 files changed, 486 insertions, 196 deletions

diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c
index 1b3a57f..a7ac7f9 100644
--- a/sys/cam/ctl/ctl.c
+++ b/sys/cam/ctl/ctl.c
@@ -12393,6 +12393,9 @@ ctl_datamove(union ctl_io *io)
 	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
 		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
 	} else {
+		struct ctl_lun *lun;
+
+		lun = CTL_LUN(io);
 		if ((lun != NULL)
 		 && (lun->delay_info.datamove_delay > 0)) {
 
diff --git a/sys/cam/ctl/ctl_backend_ramdisk.c b/sys/cam/ctl/ctl_backend_ramdisk.c
index b743bc6..ba3fa1c 100644
--- a/sys/cam/ctl/ctl_backend_ramdisk.c
+++ b/sys/cam/ctl/ctl_backend_ramdisk.c
@@ -1120,8 +1120,10 @@ ctl_backend_ramdisk_create(struct ctl_be_ramdisk_softc *softc,
 
 	STAILQ_INIT(&be_lun->cont_queue);
 	sx_init(&be_lun->page_lock, "cram page lock");
-	if (be_lun->cap_bytes == 0)
+	if (be_lun->cap_bytes == 0) {
+		be_lun->indir = 0;
 		be_lun->pages = malloc(be_lun->pblocksize, M_RAMDISK, M_WAITOK);
+	}
 	be_lun->zero_page = malloc(be_lun->pblocksize, M_RAMDISK,
 	    M_WAITOK|M_ZERO);
 	mtx_init(&be_lun->queue_lock, "cram queue lock", NULL, MTX_DEF);
diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
index a087e6e..cb12cee 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c
@@ -155,7 +155,7 @@ int		dtrace_destructive_disallow = 0;
 dtrace_optval_t	dtrace_nonroot_maxsize = (16 * 1024 * 1024);
 size_t		dtrace_difo_maxsize = (256 * 1024);
 dtrace_optval_t	dtrace_dof_maxsize = (8 * 1024 * 1024);
-size_t		dtrace_global_maxsize = (16 * 1024);
+size_t		dtrace_statvar_maxsize = (16 * 1024);
 size_t		dtrace_actions_max = (16 * 1024);
 size_t		dtrace_retain_max = 1024;
 dtrace_optval_t	dtrace_helper_actions_max = 128;
@@ -699,13 +699,33 @@ dtrace_canstore_statvar(uint64_t addr, size_t sz,
     dtrace_statvar_t **svars, int nsvars)
 {
 	int i;
+	size_t maxglobalsize, maxlocalsize;
+
+	if (nsvars == 0)
+		return (0);
+
+	maxglobalsize = dtrace_statvar_maxsize;
+	maxlocalsize = (maxglobalsize + sizeof (uint64_t)) * NCPU;
 
 	for (i = 0; i < nsvars; i++) {
 		dtrace_statvar_t *svar = svars[i];
+		uint8_t scope;
+		size_t size;
 
-		if (svar == NULL || svar->dtsv_size == 0)
+		if (svar == NULL || (size = svar->dtsv_size) == 0)
 			continue;
 
+		scope = svar->dtsv_var.dtdv_scope;
+
+		/*
+		 * We verify that our size is valid in the spirit of providing
+		 * defense in depth:  we want to prevent attackers from using
+		 * DTrace to escalate an orthogonal kernel heap corruption bug
+		 * into the ability to store to arbitrary locations in memory.
+		 */
+		VERIFY((scope == DIFV_SCOPE_GLOBAL && size < maxglobalsize) ||
+		    (scope == DIFV_SCOPE_LOCAL && size < maxlocalsize));
+
 		if (DTRACE_INRANGE(addr, sz, svar->dtsv_data, svar->dtsv_size))
 			return (1);
 	}
@@ -4455,7 +4475,8 @@ dtrace_dif_subr(uint_t subr, uint_t rd, uint64_t *regs,
 
 		if (!dtrace_destructive_disallow &&
 		    dtrace_priv_proc_control(state) &&
-		    !dtrace_istoxic(kaddr, size)) {
+		    !dtrace_istoxic(kaddr, size) &&
+		    dtrace_canload(kaddr, size, mstate, vstate)) {
 			DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
 			dtrace_copyout(kaddr, uaddr, size, flags);
 			DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
@@ -4470,7 +4491,8 @@ dtrace_dif_subr(uint_t subr, uint_t rd, uint64_t *regs,
 
 		if (!dtrace_destructive_disallow &&
 		    dtrace_priv_proc_control(state) &&
-		    !dtrace_istoxic(kaddr, size)) {
+		    !dtrace_istoxic(kaddr, size) &&
+		    dtrace_strcanload(kaddr, size, mstate, vstate)) {
 			DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
 			dtrace_copyoutstr(kaddr, uaddr, size, flags);
 			DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
@@ -6458,6 +6480,11 @@ dtrace_dif_emulate(dtrace_difo_t *difo, dtrace_mstate_t *mstate,
 				    regs[r2] ? regs[r2] :
 				    dtrace_strsize_default) + 1;
 			} else {
+				if (regs[r2] > LONG_MAX) {
+					*flags |= CPU_DTRACE_ILLOP;
+					break;
+				}
+
 				tupregs[ttop].dttk_size = regs[r2];
 			}
 
@@ -9919,9 +9946,10 @@ dtrace_difo_validate(dtrace_difo_t *dp, dtrace_vstate_t *vstate, uint_t nregs,
 				break;
 			}
 
-			if (v->dtdv_scope == DIFV_SCOPE_GLOBAL &&
-			    vt->dtdt_size > dtrace_global_maxsize) {
-				err += efunc(i, "oversized by-ref global\n");
+			if ((v->dtdv_scope == DIFV_SCOPE_GLOBAL ||
+			    v->dtdv_scope == DIFV_SCOPE_LOCAL) &&
+			    vt->dtdt_size > dtrace_statvar_maxsize) {
+				err += efunc(i, "oversized by-ref static\n");
 				break;
 			}
 		}
@@ -10265,6 +10293,9 @@ dtrace_difo_chunksize(dtrace_difo_t *dp, dtrace_vstate_t *vstate)
 				if (srd == 0)
 					return;
 
+				if (sval > LONG_MAX)
+					return;
+
 				tupregs[ttop++].dttk_size = sval;
 			}
 
@@ -10326,6 +10357,19 @@ dtrace_difo_chunksize(dtrace_difo_t *dp, dtrace_vstate_t *vstate)
 		 */
 		size = P2ROUNDUP(size, sizeof (uint64_t));
 
+		/*
+		 * Before setting the chunk size, check that we're not going
+		 * to set it to a negative value...
+		 */
+		if (size > LONG_MAX)
+			return;
+
+		/*
+		 * ...and make certain that we didn't badly overflow.
+		 */
+		if (size < ksize || size < sizeof (dtrace_dynvar_t))
+			return;
+
 		if (size > vstate->dtvs_dynvars.dtds_chunksize)
 			vstate->dtvs_dynvars.dtds_chunksize = size;
 	}
@@ -13945,6 +13989,8 @@ dtrace_dstate_init(dtrace_dstate_t *dstate, size_t size)
 	if ((dstate->dtds_chunksize = chunksize) == 0)
 		dstate->dtds_chunksize = DTRACE_DYNVAR_CHUNKSIZE;
 
+	VERIFY(dstate->dtds_chunksize < LONG_MAX);
+
 	if (size < (min = dstate->dtds_chunksize + sizeof (dtrace_dynhash_t)))
 		size = min;
 
@@ -13985,6 +14031,9 @@ dtrace_dstate_init(dtrace_dstate_t *dstate, size_t size)
 	    ((uintptr_t)base + hashsize * sizeof (dtrace_dynhash_t));
 	limit = (uintptr_t)base + size;
 
+	VERIFY((uintptr_t)start < limit);
+	VERIFY((uintptr_t)start >= (uintptr_t)base);
+
 	maxper = (limit - (uintptr_t)start) / NCPU;
 	maxper = (maxper / dstate->dtds_chunksize) * dstate->dtds_chunksize;
 
@@ -14010,7 +14059,7 @@ dtrace_dstate_init(dtrace_dstate_t *dstate, size_t size)
 			start = (dtrace_dynvar_t *)limit;
 		}
 
-		ASSERT(limit <= (uintptr_t)base + size);
+		VERIFY(limit <= (uintptr_t)base + size);
 
 		for (;;) {
 			next = (dtrace_dynvar_t *)((uintptr_t)dvar +
@@ -14019,6 +14068,8 @@ dtrace_dstate_init(dtrace_dstate_t *dstate, size_t size)
 			if ((uintptr_t)next + dstate->dtds_chunksize >= limit)
 				break;
 
+			VERIFY((uintptr_t)dvar >= (uintptr_t)base &&
+			    (uintptr_t)dvar <= (uintptr_t)base + size);
 			dvar->dtdv_next = next;
 			dvar = next;
 		}
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
index d6ccf3d..a6904de 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
@@ -709,7 +709,6 @@ typedef struct arc_stats {
 	kstat_named_t arcstat_l2_size;
 	kstat_named_t arcstat_l2_asize;
 	kstat_named_t arcstat_l2_hdr_size;
-	kstat_named_t arcstat_l2_padding_needed;
 	kstat_named_t arcstat_l2_write_trylock_fail;
 	kstat_named_t arcstat_l2_write_passed_headroom;
 	kstat_named_t arcstat_l2_write_spa_mismatch;
@@ -807,7 +806,6 @@ static arc_stats_t arc_stats = {
 	{ "l2_size",			KSTAT_DATA_UINT64 },
 	{ "l2_asize",			KSTAT_DATA_UINT64 },
 	{ "l2_hdr_size",		KSTAT_DATA_UINT64 },
-	{ "l2_padding_needed",		KSTAT_DATA_UINT64 },
 	{ "l2_write_trylock_fail",	KSTAT_DATA_UINT64 },
 	{ "l2_write_passed_headroom",	KSTAT_DATA_UINT64 },
 	{ "l2_write_spa_mismatch",	KSTAT_DATA_UINT64 },
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
index 9eaa7d2..9ac5fc2 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
@@ -1604,16 +1604,21 @@ zfsctl_snapshot_vptocnp(struct vop_vptocnp_args *ap)
 	}
 	if (sep == NULL) {
 		mutex_exit(&sdp->sd_lock);
-		error = ENOENT;
+		error = SET_ERROR(ENOENT);
 	} else {
 		size_t len;
 
 		len = strlen(sep->se_name);
-		*ap->a_buflen -= len;
-		bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
-		mutex_exit(&sdp->sd_lock);
-		vref(dvp);
-		*ap->a_vpp = dvp;
+		if (*ap->a_buflen < len) {
+			mutex_exit(&sdp->sd_lock);
+			error = SET_ERROR(ENOMEM);
+		} else {
+			*ap->a_buflen -= len;
+			bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
+			mutex_exit(&sdp->sd_lock);
+			vref(dvp);
+			*ap->a_vpp = dvp;
+		}
 	}
 	VN_RELE(dvp);
 
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
index fa22523..bdab09e 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
+++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
@@ -5984,6 +5984,10 @@ zfs_vptocnp(struct vop_vptocnp_args *ap)
 		error = zfs_znode_parent_and_name(zp, &dzp, name);
 		if (error == 0) {
 			len = strlen(name);
+			if (*ap->a_buflen < len)
+				error = SET_ERROR(ENOMEM);
+		}
+		if (error == 0) {
 			*ap->a_buflen -= len;
 			bcopy(name, ap->a_buf + *ap->a_buflen, len);
 			*ap->a_vpp = ZTOV(dzp);
diff --git a/sys/cddl/contrib/opensolaris/uts/common/sys/dtrace_impl.h b/sys/cddl/contrib/opensolaris/uts/common/sys/dtrace_impl.h
index a65d1ae..1ec9091 100644
--- a/sys/cddl/contrib/opensolaris/uts/common/sys/dtrace_impl.h
+++ b/sys/cddl/contrib/opensolaris/uts/common/sys/dtrace_impl.h
@@ -1317,16 +1317,19 @@ extern void dtrace_copystr(uintptr_t, uintptr_t, size_t, volatile uint16_t *);
 /*
  * DTrace Assertions
  *
- * DTrace calls ASSERT from probe context.  To assure that a failed ASSERT
- * does not induce a markedly more catastrophic failure (e.g., one from which
- * a dump cannot be gleaned), DTrace must define its own ASSERT to be one that
- * may safely be called from probe context.  This header file must thus be
- * included by any DTrace component that calls ASSERT from probe context, and
- * _only_ by those components.  (The only exception to this is kernel
- * debugging infrastructure at user-level that doesn't depend on calling
- * ASSERT.)
+ * DTrace calls ASSERT and VERIFY from probe context.  To assure that a failed
+ * ASSERT or VERIFY does not induce a markedly more catastrophic failure (e.g.,
+ * one from which a dump cannot be gleaned), DTrace must define its own ASSERT
+ * and VERIFY macros to be ones that may safely be called from probe context.
+ * This header file must thus be included by any DTrace component that calls
+ * ASSERT and/or VERIFY from probe context, and _only_ by those components.
+ * (The only exception to this is kernel debugging infrastructure at user-level
+ * that doesn't depend on calling ASSERT.)
  */
 #undef ASSERT
+#undef VERIFY
+#define	VERIFY(EX)	((void)((EX) || \
+			dtrace_assfail(#EX, __FILE__, __LINE__)))
 #ifdef DEBUG
 #define	ASSERT(EX)	((void)((EX) || \
 			dtrace_assfail(#EX, __FILE__, __LINE__)))
diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c
index db5e45d..f1ad912 100644
--- a/sys/compat/freebsd32/freebsd32_misc.c
+++ b/sys/compat/freebsd32/freebsd32_misc.c
@@ -598,7 +598,8 @@ freebsd32_mmap(struct thread *td, struct freebsd32_mmap_args *uap)
 
 #ifdef COMPAT_FREEBSD6
 int
-freebsd6_freebsd32_mmap(struct thread *td, struct freebsd6_freebsd32_mmap_args *uap)
+freebsd6_freebsd32_mmap(struct thread *td,
+    struct freebsd6_freebsd32_mmap_args *uap)
 {
 	struct freebsd32_mmap_args ap;
 
diff --git a/sys/contrib/ipfilter/netinet/ip_fil.h b/sys/contrib/ipfilter/netinet/ip_fil.h
index 01ccd1d..170cc53 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.h
+++ b/sys/contrib/ipfilter/netinet/ip_fil.h
@@ -11,6 +11,10 @@
 #ifndef	__IP_FIL_H__
 #define	__IP_FIL_H__
 
+#if !defined(linux) || !defined(_KERNEL)
+# include <netinet/in.h>
+#endif
+
 #include "netinet/ip_compat.h"
 #include "netinet/ipf_rb.h"
 #if NETBSD_GE_REV(104040000)
@@ -24,10 +28,6 @@
 # endif
 #endif
 
-#if !defined(linux) || !defined(_KERNEL)
-# include <netinet/in.h>
-#endif
-
 #ifndef	SOLARIS
 # if defined(sun) && (defined(__svr4__) || defined(__SVR4))
 #  define	SOLARIS		1
diff --git a/sys/dev/alc/if_alc.c b/sys/dev/alc/if_alc.c
index 76e4614..e789a1d 100644
--- a/sys/dev/alc/if_alc.c
+++ b/sys/dev/alc/if_alc.c
@@ -122,6 +122,8 @@ static struct alc_ident alc_ident_table[] = {
 		"Killer E2200 Gigabit Ethernet" },
 	{ VENDORID_ATHEROS, DEVICEID_ATHEROS_E2400, 9 * 1024,
 		"Killer E2400 Gigabit Ethernet" },
+	{ VENDORID_ATHEROS, DEVICEID_ATHEROS_E2500, 9 * 1024,
+		"Killer E2500 Gigabit Ethernet" },
 	{ 0, 0, 0, NULL}
 };
 
@@ -1082,6 +1084,7 @@ alc_phy_down(struct alc_softc *sc)
 	case DEVICEID_ATHEROS_AR8161:
 	case DEVICEID_ATHEROS_E2200:
 	case DEVICEID_ATHEROS_E2400:
+	case DEVICEID_ATHEROS_E2500:
 	case DEVICEID_ATHEROS_AR8162:
 	case DEVICEID_ATHEROS_AR8171:
 	case DEVICEID_ATHEROS_AR8172:
@@ -1401,6 +1404,7 @@ alc_attach(device_t dev)
 	switch (sc->alc_ident->deviceid) {
 	case DEVICEID_ATHEROS_E2200:
 	case DEVICEID_ATHEROS_E2400:
+	case DEVICEID_ATHEROS_E2500:
 		sc->alc_flags |= ALC_FLAG_E2X00;
 		/* FALLTHROUGH */
 	case DEVICEID_ATHEROS_AR8161:
@@ -1479,7 +1483,8 @@ alc_attach(device_t dev)
 		if (alc_dma_burst[sc->alc_dma_wr_burst] > 1024)
 			sc->alc_dma_wr_burst = 3;
 		/*
-		 * Force maximum payload size to 128 bytes for E2200/E2400.
+		 * Force maximum payload size to 128 bytes for
+		 * E2200/E2400/E2500.
 		 * Otherwise it triggers DMA write error.
 		 */
 		if ((sc->alc_flags & ALC_FLAG_E2X00) != 0)
diff --git a/sys/dev/alc/if_alcreg.h b/sys/dev/alc/if_alcreg.h
index ae63084..29d877d 100644
--- a/sys/dev/alc/if_alcreg.h
+++ b/sys/dev/alc/if_alcreg.h
@@ -50,6 +50,7 @@
 #define	DEVICEID_ATHEROS_AR8172		0x10A0
 #define	DEVICEID_ATHEROS_E2200		0xE091
 #define	DEVICEID_ATHEROS_E2400		0xE0A1
+#define	DEVICEID_ATHEROS_E2500		0xE0B1
 
 #define	ATHEROS_AR8152_B_V10		0xC0
 #define	ATHEROS_AR8152_B_V11		0xC1
diff --git a/sys/dev/e1000/if_em.c b/sys/dev/e1000/if_em.c
index 6b6b791..e9ab2f6 100644
--- a/sys/dev/e1000/if_em.c
+++ b/sys/dev/e1000/if_em.c
@@ -5156,7 +5156,7 @@ em_enable_intr(struct adapter *adapter)
 	u32 ims_mask = IMS_ENABLE_MASK;
 
 	if (hw->mac.type == e1000_82574) {
-		E1000_WRITE_REG(hw, EM_EIAC, adapter->ims);
+		E1000_WRITE_REG(hw, EM_EIAC, EM_MSIX_MASK);
 		ims_mask |= adapter->ims;
 	} 
 	E1000_WRITE_REG(hw, E1000_IMS, ims_mask);
diff --git a/sys/dev/hyperv/include/hyperv.h b/sys/dev/hyperv/include/hyperv.h
index 0eda9f0..f0161fc 100644
--- a/sys/dev/hyperv/include/hyperv.h
+++ b/sys/dev/hyperv/include/hyperv.h
@@ -79,9 +79,17 @@ struct hyperv_guid {
 
 #define HYPERV_GUID_STRLEN		40
 
-int		hyperv_guid2str(const struct hyperv_guid *, char *, size_t);
+typedef uint64_t			(*hyperv_tc64_t)(void);
 
-extern u_int	hyperv_features;	/* CPUID_HV_MSR_ */
+int			hyperv_guid2str(const struct hyperv_guid *, char *,
+			    size_t);
+
+/*
+ * hyperv_tc64 could be NULL, if there were no suitable Hyper-V
+ * specific timecounter.
+ */
+extern hyperv_tc64_t	hyperv_tc64;
+extern u_int		hyperv_features;	/* CPUID_HV_MSR_ */
 
 #endif	/* _KERNEL */
 
diff --git a/sys/dev/hyperv/netvsc/hn_nvs.c b/sys/dev/hyperv/netvsc/hn_nvs.c
index aa61a33..b4e9b1a 100644
--- a/sys/dev/hyperv/netvsc/hn_nvs.c
+++ b/sys/dev/hyperv/netvsc/hn_nvs.c
@@ -500,6 +500,8 @@ hn_nvs_conf_ndis(struct hn_softc *sc, int mtu)
 	conf.nvs_type = HN_NVS_TYPE_NDIS_CONF;
 	conf.nvs_mtu = mtu;
 	conf.nvs_caps = HN_NVS_NDIS_CONF_VLAN;
+	if (sc->hn_nvs_ver >= HN_NVS_VERSION_5)
+		conf.nvs_caps |= HN_NVS_NDIS_CONF_SRIOV;
 
 	/* NOTE: No response. */
 	error = hn_nvs_req_send(sc, &conf, sizeof(conf));
@@ -719,3 +721,15 @@ hn_nvs_send_rndis_ctrl(struct vmbus_channel *chan,
 	return hn_nvs_send_rndis_sglist(chan, HN_NVS_RNDIS_MTYPE_CTRL,
 	    sndc, gpa, gpa_cnt);
 }
+
+void
+hn_nvs_set_datapath(struct hn_softc *sc, uint32_t path)
+{
+	struct hn_nvs_datapath dp;
+
+	memset(&dp, 0, sizeof(dp));
+	dp.nvs_type = HN_NVS_TYPE_SET_DATAPATH;
+	dp.nvs_active_path = path;
+
+	hn_nvs_req_send(sc, &dp, sizeof(dp));
+}
diff --git a/sys/dev/hyperv/netvsc/hn_nvs.h b/sys/dev/hyperv/netvsc/hn_nvs.h
index 49b03e0..f716abf 100644
--- a/sys/dev/hyperv/netvsc/hn_nvs.h
+++ b/sys/dev/hyperv/netvsc/hn_nvs.h
@@ -100,6 +100,7 @@ void		hn_nvs_sent_xact(struct hn_nvs_sendctx *sndc,
 int		hn_nvs_send_rndis_ctrl(struct vmbus_channel *chan,
 		    struct hn_nvs_sendctx *sndc, struct vmbus_gpa *gpa,
 		    int gpa_cnt);
+void		hn_nvs_set_datapath(struct hn_softc *sc, uint32_t path);
 
 extern struct hn_nvs_sendctx	hn_nvs_sendctx_none;
 
diff --git a/sys/dev/hyperv/netvsc/if_hn.c b/sys/dev/hyperv/netvsc/if_hn.c
index 8750ab0..8e99eef 100644
--- a/sys/dev/hyperv/netvsc/if_hn.c
+++ b/sys/dev/hyperv/netvsc/if_hn.c
@@ -77,6 +77,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/taskqueue.h>
 #include <sys/buf_ring.h>
+#include <sys/eventhandler.h>
 
 #include <machine/atomic.h>
 #include <machine/in_cksum.h>
@@ -85,6 +86,7 @@ __FBSDID("$FreeBSD$");
 #include <net/ethernet.h>
 #include <net/if.h>
 #include <net/if_arp.h>
+#include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
 #include <net/if_var.h>
@@ -211,6 +213,11 @@ struct hn_rxinfo {
 	uint32_t			hash_value;
 };
 
+struct hn_update_vf {
+	struct hn_rx_ring	*rxr;
+	struct ifnet		*vf;
+};
+
 #define HN_RXINFO_VLAN			0x0001
 #define HN_RXINFO_CSUM			0x0002
 #define HN_RXINFO_HASHINF		0x0004
@@ -287,8 +294,9 @@ static int			hn_txagg_pkts_sysctl(SYSCTL_HANDLER_ARGS);
 static int			hn_txagg_pktmax_sysctl(SYSCTL_HANDLER_ARGS);
 static int			hn_txagg_align_sysctl(SYSCTL_HANDLER_ARGS);
 static int			hn_polling_sysctl(SYSCTL_HANDLER_ARGS);
+static int			hn_vf_sysctl(SYSCTL_HANDLER_ARGS);
 
-static void			hn_stop(struct hn_softc *);
+static void			hn_stop(struct hn_softc *, bool);
 static void			hn_init_locked(struct hn_softc *);
 static int			hn_chan_attach(struct hn_softc *,
 				    struct vmbus_channel *);
@@ -696,7 +704,8 @@ hn_rxfilter_config(struct hn_softc *sc)
 
 	HN_LOCK_ASSERT(sc);
 
-	if (ifp->if_flags & IFF_PROMISC) {
+	if ((ifp->if_flags & IFF_PROMISC) ||
+	    (sc->hn_flags & HN_FLAG_VF)) {
 		filter = NDIS_PACKET_TYPE_PROMISCUOUS;
 	} else {
 		filter = NDIS_PACKET_TYPE_DIRECTED;
@@ -883,6 +892,122 @@ hn_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
 	ifmr->ifm_active |= IFM_10G_T | IFM_FDX;
 }
 
+static void
+hn_update_vf_task(void *arg, int pending __unused)
+{
+	struct hn_update_vf *uv = arg;
+
+	uv->rxr->hn_vf = uv->vf;
+}
+
+static void
+hn_update_vf(struct hn_softc *sc, struct ifnet *vf)
+{
+	struct hn_rx_ring *rxr;
+	struct hn_update_vf uv;
+	struct task task;
+	int i;
+
+	HN_LOCK_ASSERT(sc);
+
+	TASK_INIT(&task, 0, hn_update_vf_task, &uv);
+
+	for (i = 0; i < sc->hn_rx_ring_cnt; ++i) {
+		rxr = &sc->hn_rx_ring[i];
+
+		if (i < sc->hn_rx_ring_inuse) {
+			uv.rxr = rxr;
+			uv.vf = vf;
+			vmbus_chan_run_task(rxr->hn_chan, &task);
+		} else {
+			rxr->hn_vf = vf;
+		}
+	}
+}
+
+static void
+hn_set_vf(struct hn_softc *sc, struct ifnet *ifp, bool vf)
+{
+	struct ifnet *hn_ifp;
+
+	HN_LOCK(sc);
+
+	if (!(sc->hn_flags & HN_FLAG_SYNTH_ATTACHED))
+		goto out;
+
+	hn_ifp = sc->hn_ifp;
+
+	if (ifp == hn_ifp)
+		goto out;
+
+	if (ifp->if_alloctype != IFT_ETHER)
+		goto out;
+
+	/* Ignore lagg/vlan interfaces */
+	if (strcmp(ifp->if_dname, "lagg") == 0 ||
+	    strcmp(ifp->if_dname, "vlan") == 0)
+		goto out;
+
+	if (bcmp(IF_LLADDR(ifp), IF_LLADDR(hn_ifp), ETHER_ADDR_LEN) != 0)
+		goto out;
+
+	/* Now we're sure 'ifp' is a real VF device. */
+	if (vf) {
+		if (sc->hn_flags & HN_FLAG_VF)
+			goto out;
+
+		sc->hn_flags |= HN_FLAG_VF;
+		hn_rxfilter_config(sc);
+	} else {
+		if (!(sc->hn_flags & HN_FLAG_VF))
+			goto out;
+
+		sc->hn_flags &= ~HN_FLAG_VF;
+		if (sc->hn_ifp->if_drv_flags & IFF_DRV_RUNNING)
+			hn_rxfilter_config(sc);
+		else
+			hn_set_rxfilter(sc, NDIS_PACKET_TYPE_NONE);
+	}
+
+	hn_nvs_set_datapath(sc,
+	    vf ? HN_NVS_DATAPATH_VF : HN_NVS_DATAPATH_SYNTHETIC);
+
+	hn_update_vf(sc, vf ? ifp : NULL);
+
+	if (vf) {
+		hn_suspend_mgmt(sc);
+		sc->hn_link_flags &=
+		    ~(HN_LINK_FLAG_LINKUP | HN_LINK_FLAG_NETCHG);
+		if_link_state_change(sc->hn_ifp, LINK_STATE_DOWN);
+	} else {
+		hn_resume_mgmt(sc);
+	}
+
+	devctl_notify("HYPERV_NIC_VF", if_name(hn_ifp),
+	    vf ? "VF_UP" : "VF_DOWN", NULL);
+
+	if (bootverbose)
+		if_printf(hn_ifp, "Data path is switched %s %s\n",
+		    vf ? "to" : "from", if_name(ifp));
+out:
+	HN_UNLOCK(sc);
+}
+
+static void
+hn_ifnet_event(void *arg, struct ifnet *ifp, int event)
+{
+	if (event != IFNET_EVENT_UP && event != IFNET_EVENT_DOWN)
+		return;
+
+	hn_set_vf(arg, ifp, event == IFNET_EVENT_UP);
+}
+
+static void
+hn_ifaddr_event(void *arg, struct ifnet *ifp)
+{
+	hn_set_vf(arg, ifp, ifp->if_flags & IFF_UP);
+}
+
 /* {F8615163-DF3E-46c5-913F-F2D2F965ED0E} */
 static const struct hyperv_guid g_net_vsc_device_type = {
 	.hv_guid = {0x63, 0x51, 0x61, 0xF8, 0x3E, 0xDF, 0xc5, 0x46,
@@ -1111,6 +1236,9 @@ hn_attach(device_t dev)
 	    CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc, 0,
 	    hn_polling_sysctl, "I",
 	    "Polling frequency: [100,1000000], 0 disable polling");
+	SYSCTL_ADD_PROC(ctx, child, OID_AUTO, "vf",
+	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, sc, 0,
+	    hn_vf_sysctl, "A", "Virtual Function's name");
 
 	/*
 	 * Setup the ifmedia, which has been initialized earlier.
@@ -1204,6 +1332,12 @@ hn_attach(device_t dev)
 	sc->hn_mgmt_taskq = sc->hn_mgmt_taskq0;
 	hn_update_link_status(sc);
 
+	sc->hn_ifnet_evthand = EVENTHANDLER_REGISTER(ifnet_event,
+	    hn_ifnet_event, sc, EVENTHANDLER_PRI_ANY);
+
+	sc->hn_ifaddr_evthand = EVENTHANDLER_REGISTER(ifaddr_event,
+	    hn_ifaddr_event, sc, EVENTHANDLER_PRI_ANY);
+
 	return (0);
 failed:
 	if (sc->hn_flags & HN_FLAG_SYNTH_ATTACHED)
@@ -1218,6 +1352,11 @@ hn_detach(device_t dev)
 	struct hn_softc *sc = device_get_softc(dev);
 	struct ifnet *ifp = sc->hn_ifp;
 
+	if (sc->hn_ifaddr_evthand != NULL)
+		EVENTHANDLER_DEREGISTER(ifaddr_event, sc->hn_ifaddr_evthand);
+	if (sc->hn_ifnet_evthand != NULL)
+		EVENTHANDLER_DEREGISTER(ifnet_event, sc->hn_ifnet_evthand);
+
 	if (sc->hn_xact != NULL && vmbus_chan_is_revoked(sc->hn_prichan)) {
 		/*
 		 * In case that the vmbus missed the orphan handler
@@ -1230,7 +1369,7 @@ hn_detach(device_t dev)
 		HN_LOCK(sc);
 		if (sc->hn_flags & HN_FLAG_SYNTH_ATTACHED) {
 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
-				hn_stop(sc);
+				hn_stop(sc, true);
 			/*
 			 * NOTE:
 			 * hn_stop() only suspends data, so managment
@@ -2113,20 +2252,15 @@ static int
 hn_rxpkt(struct hn_rx_ring *rxr, const void *data, int dlen,
     const struct hn_rxinfo *info)
 {
-	struct ifnet *ifp = rxr->hn_ifp;
+	struct ifnet *ifp;
 	struct mbuf *m_new;
 	int size, do_lro = 0, do_csum = 1;
 	int hash_type = M_HASHTYPE_OPAQUE;
 
-	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
-		return (0);
+	/* If the VF is active, inject the packet through the VF */
+	ifp = rxr->hn_vf ? rxr->hn_vf : rxr->hn_ifp;
 
-	/*
-	 * Bail out if packet contains more data than configured MTU.
-	 */
-	if (dlen > (ifp->if_mtu + ETHER_HDR_LEN)) {
-		return (0);
-	} else if (dlen <= MHLEN) {
+	if (dlen <= MHLEN) {
 		m_new = m_gethdr(M_NOWAIT, MT_DATA);
 		if (m_new == NULL) {
 			if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1);
@@ -2434,7 +2568,7 @@ hn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 			}
 		} else {
 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
-				hn_stop(sc);
+				hn_stop(sc, false);
 		}
 		sc->hn_if_flags = ifp->if_flags;
 
@@ -2524,7 +2658,7 @@ hn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 }
 
 static void
-hn_stop(struct hn_softc *sc)
+hn_stop(struct hn_softc *sc, bool detaching)
 {
 	struct ifnet *ifp = sc->hn_ifp;
 	int i;
@@ -2545,6 +2679,13 @@ hn_stop(struct hn_softc *sc)
 	atomic_clear_int(&ifp->if_drv_flags, IFF_DRV_OACTIVE);
 	for (i = 0; i < sc->hn_tx_ring_inuse; ++i)
 		sc->hn_tx_ring[i].hn_oactive = 0;
+
+	/*
+	 * If the VF is active, make sure the filter is not 0, even if
+	 * the synthetic NIC is down.
+	 */
+	if (!detaching && (sc->hn_flags & HN_FLAG_VF))
+		hn_rxfilter_config(sc);
 }
 
 static void
@@ -3071,6 +3212,22 @@ hn_rss_hash_sysctl(SYSCTL_HANDLER_ARGS)
 }
 
 static int
+hn_vf_sysctl(SYSCTL_HANDLER_ARGS)
+{
+	struct hn_softc *sc = arg1;
+	char vf_name[128];
+	struct ifnet *vf;
+
+	HN_LOCK(sc);
+	vf_name[0] = '\0';
+	vf = sc->hn_rx_ring[0].hn_vf;
+	if (vf != NULL)
+		snprintf(vf_name, sizeof(vf_name), "%s", if_name(vf));
+	HN_UNLOCK(sc);
+	return sysctl_handle_string(oidp, vf_name, sizeof(vf_name), req);
+}
+
+static int
 hn_check_iplen(const struct mbuf *m, int hoff)
 {
 	const struct ip *ip;
@@ -4297,6 +4454,7 @@ hn_chan_attach(struct hn_softc *sc, struct vmbus_channel *chan)
 	KASSERT((rxr->hn_rx_flags & HN_RX_FLAG_ATTACHED) == 0,
 	    ("RX ring %d already attached", idx));
 	rxr->hn_rx_flags |= HN_RX_FLAG_ATTACHED;
+	rxr->hn_chan = chan;
 
 	if (bootverbose) {
 		if_printf(sc->hn_ifp, "link RX ring %d to chan%u\n",
@@ -4855,7 +5013,8 @@ hn_suspend(struct hn_softc *sc)
 	/* Disable polling. */
 	hn_polling(sc, 0);
 
-	if (sc->hn_ifp->if_drv_flags & IFF_DRV_RUNNING)
+	if ((sc->hn_ifp->if_drv_flags & IFF_DRV_RUNNING) ||
+	    (sc->hn_flags & HN_FLAG_VF))
 		hn_suspend_data(sc);
 	hn_suspend_mgmt(sc);
 }
@@ -4944,9 +5103,18 @@ static void
 hn_resume(struct hn_softc *sc)
 {
 
-	if (sc->hn_ifp->if_drv_flags & IFF_DRV_RUNNING)
+	if ((sc->hn_ifp->if_drv_flags & IFF_DRV_RUNNING) ||
+	    (sc->hn_flags & HN_FLAG_VF))
 		hn_resume_data(sc);
-	hn_resume_mgmt(sc);
+
+	/*
+	 * When the VF is activated, the synthetic interface is changed
+	 * to DOWN in hn_set_vf(). Here, if the VF is still active, we
+	 * don't call hn_resume_mgmt() until the VF is deactivated in
+	 * hn_set_vf().
+	 */
+	if (!(sc->hn_flags & HN_FLAG_VF))
+		hn_resume_mgmt(sc);
 
 	/*
 	 * Re-enable polling if this interface is running and
diff --git a/sys/dev/hyperv/netvsc/if_hnreg.h b/sys/dev/hyperv/netvsc/if_hnreg.h
index a3b2b8b..a964b4f 100644
--- a/sys/dev/hyperv/netvsc/if_hnreg.h
+++ b/sys/dev/hyperv/netvsc/if_hnreg.h
@@ -133,6 +133,17 @@ struct hn_nvs_ndis_init {
 } __packed;
 CTASSERT(sizeof(struct hn_nvs_ndis_init) >= HN_NVS_REQSIZE_MIN);
 
+#define HN_NVS_DATAPATH_SYNTHETIC	0
+#define HN_NVS_DATAPATH_VF		1
+
+/* No response */
+struct hn_nvs_datapath {
+	uint32_t	nvs_type;	/* HN_NVS_TYPE_SET_DATAPATH */
+	uint32_t	nvs_active_path;/* HN_NVS_DATAPATH_* */
+	uint32_t	nvs_rsvd[6];
+} __packed;
+CTASSERT(sizeof(struct hn_nvs_datapath) >= HN_NVS_REQSIZE_MIN);
+
 struct hn_nvs_rxbuf_conn {
 	uint32_t	nvs_type;	/* HN_NVS_TYPE_RXBUF_CONN */
 	uint32_t	nvs_gpadl;	/* RXBUF vmbus GPADL */
diff --git a/sys/dev/hyperv/netvsc/if_hnvar.h b/sys/dev/hyperv/netvsc/if_hnvar.h
index 7d5d912..9c39830 100644
--- a/sys/dev/hyperv/netvsc/if_hnvar.h
+++ b/sys/dev/hyperv/netvsc/if_hnvar.h
@@ -59,6 +59,7 @@ struct hn_tx_ring;
 
 struct hn_rx_ring {
 	struct ifnet	*hn_ifp;
+	struct ifnet	*hn_vf;		/* SR-IOV VF */
 	struct hn_tx_ring *hn_txr;
 	void		*hn_pktbuf;
 	int		hn_pktbuf_len;
@@ -85,6 +86,8 @@ struct hn_rx_ring {
 
 	void		*hn_br;		/* TX/RX bufring */
 	struct hyperv_dma hn_br_dma;
+
+	struct vmbus_channel *hn_chan;
 } __aligned(CACHE_LINE_SIZE);
 
 #define HN_TRUST_HCSUM_IP	0x0001
@@ -233,6 +236,9 @@ struct hn_softc {
 	int			hn_rss_ind_size;
 	uint32_t		hn_rss_hash;	/* NDIS_HASH_ */
 	struct ndis_rssprm_toeplitz hn_rss;
+
+	eventhandler_tag	hn_ifaddr_evthand;
+	eventhandler_tag	hn_ifnet_evthand;
 };
 
 #define HN_FLAG_RXBUF_CONNECTED		0x0001
@@ -243,6 +249,7 @@ struct hn_softc {
 #define HN_FLAG_NO_SLEEPING		0x0020
 #define HN_FLAG_RXBUF_REF		0x0040
 #define HN_FLAG_CHIM_REF		0x0080
+#define HN_FLAG_VF			0x0100
 
 #define HN_FLAG_ERRORS			(HN_FLAG_RXBUF_REF | HN_FLAG_CHIM_REF)
 
diff --git a/sys/dev/hyperv/utilities/vmbus_timesync.c b/sys/dev/hyperv/utilities/vmbus_timesync.c
index 7610027..66b1e48 100644
--- a/sys/dev/hyperv/utilities/vmbus_timesync.c
+++ b/sys/dev/hyperv/utilities/vmbus_timesync.c
@@ -52,8 +52,7 @@ __FBSDID("$FreeBSD$");
 	VMBUS_ICVER_LE(VMBUS_IC_VERSION(4, 0), (sc)->ic_msgver)
 
 #define VMBUS_TIMESYNC_DORTT(sc)	\
-	(VMBUS_TIMESYNC_MSGVER4((sc)) &&\
-	 (hyperv_features & CPUID_HV_MSR_TIME_REFCNT))
+	(VMBUS_TIMESYNC_MSGVER4((sc)) && hyperv_tc64 != NULL)
 
 static int			vmbus_timesync_probe(device_t);
 static int			vmbus_timesync_attach(device_t);
@@ -117,7 +116,7 @@ vmbus_timesync(struct vmbus_ic_softc *sc, uint64_t hvtime, uint64_t sent_tc,
 	uint64_t hv_ns, vm_ns, rtt = 0;
 
 	if (VMBUS_TIMESYNC_DORTT(sc))
-		rtt = rdmsr(MSR_HV_TIME_REF_COUNT) - sent_tc;
+		rtt = hyperv_tc64() - sent_tc;
 
 	hv_ns = (hvtime - VMBUS_ICMSG_TS_BASE + rtt) * HYPERV_TIMER_NS_FACTOR;
 	nanotime(&vm_ts);
diff --git a/sys/dev/hyperv/vmbus/amd64/hyperv_machdep.c b/sys/dev/hyperv/vmbus/amd64/hyperv_machdep.c
index 9caed81..118178f 100644
--- a/sys/dev/hyperv/vmbus/amd64/hyperv_machdep.c
+++ b/sys/dev/hyperv/vmbus/amd64/hyperv_machdep.c
@@ -118,8 +118,8 @@ hyperv_tsc_mmap(struct cdev *dev __unused, vm_ooffset_t offset,
 }
 
 #define HYPERV_TSC_TIMECOUNT(fence)					\
-static u_int								\
-hyperv_tsc_timecount_##fence(struct timecounter *tc)			\
+static uint64_t								\
+hyperv_tc64_tsc_##fence(void)						\
 {									\
 	struct hyperv_reftsc *tsc_ref = hyperv_ref_tsc.tsc_ref;		\
 	uint32_t seq;							\
@@ -150,6 +150,13 @@ hyperv_tsc_timecount_##fence(struct timecounter *tc)			\
 	/* Fallback to the generic timecounter, i.e. rdmsr. */		\
 	return (rdmsr(MSR_HV_TIME_REF_COUNT));				\
 }									\
+									\
+static u_int								\
+hyperv_tsc_timecount_##fence(struct timecounter *tc __unused)		\
+{									\
+									\
+	return (hyperv_tc64_tsc_##fence());				\
+}									\
 struct __hack
 
 HYPERV_TSC_TIMECOUNT(lfence);
@@ -158,6 +165,7 @@ HYPERV_TSC_TIMECOUNT(mfence);
 static void
 hyperv_tsc_tcinit(void *dummy __unused)
 {
+	hyperv_tc64_t tc64 = NULL;
 	uint64_t val, orig;
 
 	if ((hyperv_features &
@@ -170,11 +178,13 @@ hyperv_tsc_tcinit(void *dummy __unused)
 	case CPU_VENDOR_AMD:
 		hyperv_tsc_timecounter.tc_get_timecount =
 		    hyperv_tsc_timecount_mfence;
+		tc64 = hyperv_tc64_tsc_mfence;
 		break;
 
 	case CPU_VENDOR_INTEL:
 		hyperv_tsc_timecounter.tc_get_timecount =
 		    hyperv_tsc_timecount_lfence;
+		tc64 = hyperv_tc64_tsc_lfence;
 		break;
 
 	default:
@@ -199,6 +209,10 @@ hyperv_tsc_tcinit(void *dummy __unused)
 	/* Register "enlightened" timecounter. */
 	tc_init(&hyperv_tsc_timecounter);
 
+	/* Install 64 bits timecounter method for other modules to use. */
+	KASSERT(tc64 != NULL, ("tc64 is not set"));
+	hyperv_tc64 = tc64;
+
 	/* Add device for mmap(2). */
 	make_dev(&hyperv_tsc_cdevsw, 0, UID_ROOT, GID_WHEEL, 0444,
 	    HYPERV_REFTSC_DEVNAME);
diff --git a/sys/dev/hyperv/vmbus/hyperv.c b/sys/dev/hyperv/vmbus/hyperv.c
index 2df313b..144bff5 100644
--- a/sys/dev/hyperv/vmbus/hyperv.c
+++ b/sys/dev/hyperv/vmbus/hyperv.c
@@ -77,6 +77,8 @@ u_int				hyperv_recommends;
 static u_int			hyperv_pm_features;
 static u_int			hyperv_features3;
 
+hyperv_tc64_t			hyperv_tc64;
+
 static struct timecounter	hyperv_timecounter = {
 	.tc_get_timecount	= hyperv_get_timecount,
 	.tc_poll_pps		= NULL,
@@ -96,6 +98,13 @@ hyperv_get_timecount(struct timecounter *tc __unused)
 	return rdmsr(MSR_HV_TIME_REF_COUNT);
 }
 
+static uint64_t
+hyperv_tc64_rdmsr(void)
+{
+
+	return (rdmsr(MSR_HV_TIME_REF_COUNT));
+}
+
 uint64_t
 hypercall_post_message(bus_addr_t msg_paddr)
 {
@@ -232,6 +241,12 @@ hyperv_init(void *dummy __unused)
 	if (hyperv_features & CPUID_HV_MSR_TIME_REFCNT) {
 		/* Register Hyper-V timecounter */
 		tc_init(&hyperv_timecounter);
+
+		/*
+		 * Install 64 bits timecounter method for other modules
+		 * to use.
+		 */
+		hyperv_tc64 = hyperv_tc64_rdmsr;
 	}
 }
 SYSINIT(hyperv_initialize, SI_SUB_HYPERVISOR, SI_ORDER_FIRST, hyperv_init,
diff --git a/sys/dev/hyperv/vmbus/vmbus_et.c b/sys/dev/hyperv/vmbus/vmbus_et.c
index 1e0c746..93f2ffa 100644
--- a/sys/dev/hyperv/vmbus/vmbus_et.c
+++ b/sys/dev/hyperv/vmbus/vmbus_et.c
@@ -50,13 +50,10 @@ __FBSDID("$FreeBSD$");
 	 MSR_HV_STIMER_CFG_SINT_MASK)
 
 /*
- * Two additionally required features:
+ * Additionally required feature:
  * - SynIC is needed for interrupt generation.
- * - Time reference counter is needed to set ABS reference count to
- *   STIMER0_COUNT.
  */
-#define CPUID_HV_ET_MASK		(CPUID_HV_MSR_TIME_REFCNT |	\
-					 CPUID_HV_MSR_SYNIC |		\
+#define CPUID_HV_ET_MASK		(CPUID_HV_MSR_SYNIC |		\
 					 CPUID_HV_MSR_SYNTIMER)
 
 static void			vmbus_et_identify(driver_t *, device_t);
@@ -104,7 +101,7 @@ vmbus_et_start(struct eventtimer *et __unused, sbintime_t first,
 {
 	uint64_t current;
 
-	current = rdmsr(MSR_HV_TIME_REF_COUNT);
+	current = hyperv_tc64();
 	current += hyperv_sbintime2count(first);
 	wrmsr(MSR_HV_STIMER0_COUNT, current);
 
@@ -133,7 +130,8 @@ vmbus_et_identify(driver_t *driver, device_t parent)
 {
 	if (device_get_unit(parent) != 0 ||
 	    device_find_child(parent, VMBUS_ET_NAME, -1) != NULL ||
-	    (hyperv_features & CPUID_HV_ET_MASK) != CPUID_HV_ET_MASK)
+	    (hyperv_features & CPUID_HV_ET_MASK) != CPUID_HV_ET_MASK ||
+	    hyperv_tc64 == NULL)
 		return;
 
 	device_add_child(parent, VMBUS_ET_NAME, -1);
@@ -189,9 +187,8 @@ vmbus_et_attach(device_t dev)
 	vmbus_et.et_start = vmbus_et_start;
 
 	/*
-	 * Delay a bit to make sure that MSR_HV_TIME_REF_COUNT will
-	 * not return 0, since writing 0 to STIMER0_COUNT will disable
-	 * STIMER0.
+	 * Delay a bit to make sure that hyperv_tc64 will not return 0,
+	 * since writing 0 to STIMER0_COUNT will disable STIMER0.
 	 */
 	DELAY(100);
 	smp_rendezvous(NULL, vmbus_et_config, NULL, NULL);
diff --git a/sys/dev/isp/isp.c b/sys/dev/isp/isp.c
index 9d38f60..c77bda5 100644
--- a/sys/dev/isp/isp.c
+++ b/sys/dev/isp/isp.c
@@ -4451,11 +4451,7 @@ isp_start(XS_T *xs)
 		if (XS_TAG_P(xs)) {
 			ttype = XS_TAG_TYPE(xs);
 		} else {
-			if (XS_CDBP(xs)[0] == 0x3) {
-				ttype = REQFLAG_HTAG;
-			} else {
-				ttype = REQFLAG_STAG;
-			}
+			ttype = REQFLAG_STAG;
 		}
 		if (ttype == REQFLAG_OTAG) {
 			ttype = FCP_CMND_TASK_ATTR_ORDERED;
@@ -4479,14 +4475,7 @@ isp_start(XS_T *xs)
 		if (XS_TAG_P(xs)) {
 			((ispreqt2_t *)reqp)->req_flags = XS_TAG_TYPE(xs);
 		} else {
-			/*
-			 * If we don't know what tag to use, use HEAD OF QUEUE
-			 * for Request Sense or Simple.
-			 */
-			if (XS_CDBP(xs)[0] == 0x3)	/* REQUEST SENSE */
-				((ispreqt2_t *)reqp)->req_flags = REQFLAG_HTAG;
-			else
-				((ispreqt2_t *)reqp)->req_flags = REQFLAG_STAG;
+			((ispreqt2_t *)reqp)->req_flags = REQFLAG_STAG;
 		}
 	} else {
 		sdparam *sdp = SDPARAM(isp, XS_CHANNEL(xs));
diff --git a/sys/dev/nand/nand_geom.c b/sys/dev/nand/nand_geom.c
index 98373aa..913958a 100644
--- a/sys/dev/nand/nand_geom.c
+++ b/sys/dev/nand/nand_geom.c
@@ -416,7 +416,7 @@ create_geom_disk(struct nand_chip *chip)
 	snprintf(rdisk->d_ident, sizeof(rdisk->d_ident),
 	    "nand_raw: Man:0x%02x Dev:0x%02x", chip->id.man_id,
 	    chip->id.dev_id);
-	disk->d_rotation_rate = DISK_RR_NON_ROTATING;
+	rdisk->d_rotation_rate = DISK_RR_NON_ROTATING;
 
 	disk_create(rdisk, DISK_VERSION);
 
diff --git a/sys/dev/pci/pci.c b/sys/dev/pci/pci.c
index 26cf526..d36f4cc 100644
--- a/sys/dev/pci/pci.c
+++ b/sys/dev/pci/pci.c
@@ -269,13 +269,14 @@ static const struct pci_quirk pci_quirks[] = {
 	{ 0x43851002, PCI_QUIRK_UNMAP_REG,	0x14,	0 },
 
 	/*
-	 * Atheros AR8161/AR8162/E2200/E2400 Ethernet controllers have a
-	 * bug that MSI interrupt does not assert if PCIM_CMD_INTxDIS bit
+	 * Atheros AR8161/AR8162/E2200/E2400/E2500 Ethernet controllers have
+	 * a bug that MSI interrupt does not assert if PCIM_CMD_INTxDIS bit
 	 * of the command register is set.
 	 */
 	{ 0x10911969, PCI_QUIRK_MSI_INTX_BUG,	0,	0 },
 	{ 0xE0911969, PCI_QUIRK_MSI_INTX_BUG,	0,	0 },
 	{ 0xE0A11969, PCI_QUIRK_MSI_INTX_BUG,	0,	0 },
+	{ 0xE0B11969, PCI_QUIRK_MSI_INTX_BUG,	0,	0 },
 	{ 0x10901969, PCI_QUIRK_MSI_INTX_BUG,	0,	0 },
 
 	/*
diff --git a/sys/dev/ppbus/vpo.c b/sys/dev/ppbus/vpo.c
index a4f5226..f508275 100644
--- a/sys/dev/ppbus/vpo.c
+++ b/sys/dev/ppbus/vpo.c
@@ -316,7 +316,7 @@ vpo_action(struct cam_sim *sim, union ccb *ccb)
 		}
 #ifdef VP0_DEBUG
 		device_printf(vpo->vpo_dev, "XPT_SCSI_IO (0x%x) request\n",
-		    scsiio_cdb_ptr(csio));
+		    *scsiio_cdb_ptr(csio));
 #endif
 		vpo_intr(vpo, csio);
 
diff --git a/sys/fs/devfs/devfs_devs.c b/sys/fs/devfs/devfs_devs.c
index 288e7bc..ad7a034 100644
--- a/sys/fs/devfs/devfs_devs.c
+++ b/sys/fs/devfs/devfs_devs.c
@@ -208,7 +208,7 @@ devfs_newdirent(char *name, int namelen)
 	struct dirent d;
 
 	d.d_namlen = namelen;
-	i = sizeof (*de) + GENERIC_DIRSIZ(&d); 
+	i = sizeof(*de) + GENERIC_DIRSIZ(&d);
 	de = malloc(i, M_DEVFS3, M_WAITOK | M_ZERO);
 	de->de_dirent = (struct dirent *)(de + 1);
 	de->de_dirent->d_namlen = namelen;
@@ -246,7 +246,8 @@ devfs_parent_dirent(struct devfs_dirent *de)
 }
 
 struct devfs_dirent *
-devfs_vmkdir(struct devfs_mount *dmp, char *name, int namelen, struct devfs_dirent *dotdot, u_int inode)
+devfs_vmkdir(struct devfs_mount *dmp, char *name, int namelen,
+    struct devfs_dirent *dotdot, u_int inode)
 {
 	struct devfs_dirent *dd;
 	struct devfs_dirent *de;
diff --git a/sys/fs/nfsserver/nfs_nfsdkrpc.c b/sys/fs/nfsserver/nfs_nfsdkrpc.c
index 0b2333f..5c47447 100644
--- a/sys/fs/nfsserver/nfs_nfsdkrpc.c
+++ b/sys/fs/nfsserver/nfs_nfsdkrpc.c
@@ -554,18 +554,16 @@ nfsrvd_init(int terminating)
 		nfsd_master_proc = NULL;
 		NFSD_UNLOCK();
 		nfsrv_freeallbackchannel_xprts();
-		svcpool_destroy(nfsrvd_pool);
-		nfsrvd_pool = NULL;
+		svcpool_close(nfsrvd_pool);
+		NFSD_LOCK();
+	} else {
+		NFSD_UNLOCK();
+		nfsrvd_pool = svcpool_create("nfsd",
+		    SYSCTL_STATIC_CHILDREN(_vfs_nfsd));
+		nfsrvd_pool->sp_rcache = NULL;
+		nfsrvd_pool->sp_assign = fhanew_assign;
+		nfsrvd_pool->sp_done = fha_nd_complete;
 		NFSD_LOCK();
 	}
-
-	NFSD_UNLOCK();
-
-	nfsrvd_pool = svcpool_create("nfsd", SYSCTL_STATIC_CHILDREN(_vfs_nfsd));
-	nfsrvd_pool->sp_rcache = NULL;
-	nfsrvd_pool->sp_assign = fhanew_assign;
-	nfsrvd_pool->sp_done = fha_nd_complete;
-
-	NFSD_LOCK();
 }
 
diff --git a/sys/i386/i386/pmap.c b/sys/i386/i386/pmap.c
index c383f34..8e51753 100644
--- a/sys/i386/i386/pmap.c
+++ b/sys/i386/i386/pmap.c
@@ -1257,8 +1257,10 @@ pmap_invalidate_cache_range(vm_offset_t sva, vm_offset_t eva, boolean_t force)
 		sfence();
 	} else if ((cpu_feature & CPUID_CLFSH) != 0 &&
 	    eva - sva < PMAP_CLFLUSH_THRESHOLD) {
+#ifdef DEV_APIC
 		if (pmap_kextract(sva) == lapic_paddr)
 			return;
+#endif
 		/*
 		 * Writes are ordered by CLFLUSH on Intel CPUs.
 		 */
diff --git a/sys/kern/kern_lockf.c b/sys/kern/kern_lockf.c
index a0a3789..1740d85 100644
--- a/sys/kern/kern_lockf.c
+++ b/sys/kern/kern_lockf.c
@@ -687,7 +687,7 @@ retry_setlock:
 		break;
 	}
 
-#ifdef INVARIANTS
+#ifdef DIAGNOSTIC
 	/*
 	 * Check for some can't happen stuff. In this case, the active
 	 * lock list becoming disordered or containing mutually
@@ -915,7 +915,7 @@ lf_add_edge(struct lockf_entry *x, struct lockf_entry *y)
 	struct lockf_edge *e;
 	int error;
 
-#ifdef INVARIANTS
+#ifdef DIAGNOSTIC
 	LIST_FOREACH(e, &x->lf_outedges, le_outlink)
 		KASSERT(e->le_to != y, ("adding lock edge twice"));
 #endif
diff --git a/sys/modules/ath/Makefile b/sys/modules/ath/Makefile
index 33a1650..1bd2eb9 100644
--- a/sys/modules/ath/Makefile
+++ b/sys/modules/ath/Makefile
@@ -31,8 +31,8 @@
 
 ATH_RATE?=	sample		# tx rate control algorithm
 
-.PATH:	${.CURDIR}/../../dev/ath
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal
+.PATH:	${SRCTOP}/sys/dev/ath
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal
 
 KMOD=	if_ath
 SRCS=	if_ath.c if_ath_alq.c if_ath_debug.c if_ath_keycache.c if_ath_sysctl.c
@@ -46,7 +46,7 @@ SRCS+=	device_if.h bus_if.h pci_if.h opt_inet.h opt_ath.h opt_ah.h opt_wlan.h
 #
 # AR5210 support; these are first generation 11a-only devices.
 #
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar5210
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar5210
 SRCS+=	ah_eeprom_v1.c \
 	ar5210_attach.c ar5210_beacon.c ar5210_interrupts.c \
 	ar5210_keycache.c ar5210_misc.c ar5210_phy.c ar5210_power.c \
@@ -56,7 +56,7 @@ SRCS+=	ah_eeprom_v1.c \
 # AR5211 support; these are second generation 11b/g/a devices
 # (but 11g was OFDM only and is not supported).
 #
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar5211
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar5211
 SRCS+=	ar5211_attach.c ar5211_beacon.c ar5211_interrupts.c \
 	ar5211_keycache.c ar5211_misc.c	ar5211_phy.c ar5211_power.c \
 	ar5211_recv.c ar5211_reset.c ar5211_xmit.c
@@ -64,7 +64,7 @@ SRCS+=	ar5211_attach.c ar5211_beacon.c ar5211_interrupts.c \
 #
 # AR5212 support; this covers all other pci/cardbus legacy parts.
 #
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar5212
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar5212
 SRCS+=	ar5212_ani.c ar5212_attach.c ar5212_beacon.c ar5212_eeprom.c \
 	ar5212_gpio.c ar5212_interrupts.c ar5212_keycache.c ar5212_misc.c \
 	ar5212_phy.c ar5212_power.c ar5212_recv.c ar5212_reset.c \
@@ -85,7 +85,7 @@ SRCS+=	ar5413.c
 # NB: 9160 depends on 5416 but 5416 does not require 9160
 #
 # + 5416 (Owl)
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar5416
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar5416
 SRCS+=	ah_eeprom_v14.c ah_eeprom_v4k.c \
 	ar5416_ani.c ar5416_attach.c ar5416_beacon.c ar5416_btcoex.c \
 	ar5416_cal.c ar5416_cal_iq.c ar5416_cal_adcgain.c ar5416_cal_adcdc.c \
@@ -97,7 +97,7 @@ SRCS+=	ah_eeprom_v14.c ah_eeprom_v4k.c \
 SRCS+=	ar2133.c
 
 # + AR9160 (Sowl)
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar9001
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar9001
 SRCS+=	ar9160_attach.c
 
 # + AR9130 - (Sowl) - Embedded (AR913x SoC)
@@ -111,7 +111,7 @@ SRCS+=	ar9130_attach.c ar9130_eeprom.c ar9130_phy.c
 
 # AR9002 series chips
 # + AR9220/AR9280 - Merlin
-.PATH:	${.CURDIR}/../../dev/ath/ath_hal/ar9002
+.PATH:	${SRCTOP}/sys/dev/ath/ath_hal/ar9002
 SRCS+=	ar9280.c ar9280_attach.c ar9280_olc.c
 
 # + AR9285 - Kite
@@ -119,13 +119,13 @@ SRCS+=	ar9285.c ar9285_reset.c ar9285_attach.c ar9285_cal.c ar9285_phy.c
 SRCS+=	ar9285_diversity.c ar9285_btcoex.c
 
 # + AR9287 - Kiwi
-.PATH:  ${.CURDIR}/../../dev/ath/ath_hal
+.PATH:  ${SRCTOP}/sys/dev/ath/ath_hal
 SRCS+=  ah_eeprom_9287.c
-.PATH:  ${.CURDIR}/../../dev/ath/ath_hal/ar9002
+.PATH:  ${SRCTOP}/sys/dev/ath/ath_hal/ar9002
 SRCS+=  ar9287.c ar9287_reset.c ar9287_attach.c ar9287_cal.c ar9287_olc.c
 
 # + AR9300 HAL
-.PATH:  ${.CURDIR}/../../contrib/dev/ath/ath_hal/ar9300
+.PATH:  ${SRCTOP}/sys/contrib/dev/ath/ath_hal/ar9300
 SRCS+= ar9300_interrupts.c ar9300_radar.c ar9300_ani.c ar9300_keycache.c
 SRCS+= ar9300_radio.c ar9300_xmit.c ar9300_attach.c ar9300_mci.c ar9300_stub.c
 SRCS+= ar9300_xmit_ds.c ar9300_beacon.c ar9300_misc.c ar9300_recv.c
@@ -135,22 +135,22 @@ SRCS+= ar9300_power.c ar9300_timer.c
 
 # NB: rate control is bound to the driver by symbol names so only pick one
 .if ${ATH_RATE} == "sample"
-.PATH:	${.CURDIR}/../../dev/ath/ath_rate/sample
+.PATH:	${SRCTOP}/sys/dev/ath/ath_rate/sample
 SRCS+=	sample.c
 .elif ${ATH_RATE} == "onoe"
-.PATH:	${.CURDIR}/../../dev/ath/ath_rate/onoe
+.PATH:	${SRCTOP}/sys/dev/ath/ath_rate/onoe
 SRCS+=	onoe.c
 .elif ${ATH_RATE} == "amrr"
-.PATH:	${.CURDIR}/../../dev/ath/ath_rate/amrr
+.PATH:	${SRCTOP}/sys/dev/ath/ath_rate/amrr
 SRCS+=	amrr.c
 .endif
 
 # DFS
-.PATH: ${.CURDIR}/../../dev/ath/ath_dfs/null
+.PATH: ${SRCTOP}/sys/dev/ath/ath_dfs/null
 SRCS+=	dfs_null.c
 
-CFLAGS+=  -I. -I${.CURDIR}/../../dev/ath -I${.CURDIR}/../../dev/ath/ath_hal
-CFLAGS+=  -I. -I${.CURDIR}/../../contrib/dev/ath/ath_hal/
+CFLAGS+=  -I. -I${SRCTOP}/sys/dev/ath -I${SRCTOP}/sys/dev/ath/ath_hal
+CFLAGS+=  -I. -I${SRCTOP}/sys/contrib/dev/ath/ath_hal/
 
 .if !defined(KERNBUILDDIR)
 opt_ah.h:
diff --git a/sys/net/if.c b/sys/net/if.c
index 881cd60..625b6d0 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -2183,6 +2183,7 @@ void
 if_down(struct ifnet *ifp)
 {
 
+	EVENTHANDLER_INVOKE(ifnet_event, ifp, IFNET_EVENT_DOWN);
 	if_unroute(ifp, IFF_UP, AF_UNSPEC);
 }
 
@@ -2195,6 +2196,7 @@ if_up(struct ifnet *ifp)
 {
 
 	if_route(ifp, IFF_UP, AF_UNSPEC);
+	EVENTHANDLER_INVOKE(ifnet_event, ifp, IFNET_EVENT_UP);
 }
 
 /*
@@ -2266,7 +2268,7 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 {
 	struct ifreq *ifr;
 	struct ifstat *ifs;
-	int error = 0;
+	int error = 0, do_ifup = 0;
 	int new_flags, temp_flags;
 	size_t namelen, onamelen;
 	size_t descrlen;
@@ -2394,7 +2396,7 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 			if_down(ifp);
 		} else if (new_flags & IFF_UP &&
 		    (ifp->if_flags & IFF_UP) == 0) {
-			if_up(ifp);
+			do_ifup = 1;
 		}
 		/* See if permanently promiscuous mode bit is about to flip */
 		if ((ifp->if_flags ^ new_flags) & IFF_PPROMISC) {
@@ -2413,6 +2415,8 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td)
 		if (ifp->if_ioctl) {
 			(void) (*ifp->if_ioctl)(ifp, cmd, data);
 		}
+		if (do_ifup)
+			if_up(ifp);
 		getmicrotime(&ifp->if_lastchange);
 		break;
 
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 01ca26c..1456793 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -424,6 +424,11 @@ EVENTHANDLER_DECLARE(ifnet_departure_event, ifnet_departure_event_handler_t);
 /* Interface link state change event */
 typedef void (*ifnet_link_event_handler_t)(void *, struct ifnet *, int);
 EVENTHANDLER_DECLARE(ifnet_link_event, ifnet_link_event_handler_t);
+/* Interface up/down event */
+#define IFNET_EVENT_UP		0
+#define IFNET_EVENT_DOWN	1
+typedef void (*ifnet_event_fn)(void *, struct ifnet *ifp, int event);
+EVENTHANDLER_DECLARE(ifnet_event, ifnet_event_fn);
 
 /*
  * interface groups
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 46bebf6..3546920 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -646,13 +646,13 @@ udp_input(struct mbuf *m, int off)
 		    INPLOOKUP_RLOCKPCB, ifp, m);
 	if (inp == NULL) {
 		if (udp_log_in_vain) {
-			char buf[4*sizeof "123"];
+			char src[INET_ADDRSTRLEN];
+			char dst[INET_ADDRSTRLEN];
 
-			strcpy(buf, inet_ntoa(ip->ip_dst));
 			log(LOG_INFO,
 			    "Connection attempt to UDP %s:%d from %s:%d\n",
-			    buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
-			    ntohs(uh->uh_sport));
+			    inet_ntoa_r(ip->ip_dst, dst), ntohs(uh->uh_dport),
+			    inet_ntoa_r(ip->ip_src, src), ntohs(uh->uh_sport));
 		}
 		UDPSTAT_INC(udps_noport);
 		if (m->m_flags & (M_BCAST | M_MCAST)) {
diff --git a/sys/netpfil/ipfw/dn_heap.h b/sys/netpfil/ipfw/dn_heap.h
index c95473a..d51d9b0 100644
--- a/sys/netpfil/ipfw/dn_heap.h
+++ b/sys/netpfil/ipfw/dn_heap.h
@@ -85,7 +85,7 @@ enum {
  * HEAP_TOP() returns a pointer to the top element of the heap,
  *	but makes no checks on its existance (XXX should we change ?)
  *
- * heap_extract() removes the entry at the top, returing the pointer.
+ * heap_extract() removes the entry at the top, returning the pointer.
  *	(the key should have been read before).
  *
  * heap_scan() invokes a callback on each entry of the heap.
diff --git a/sys/rpc/svc.c b/sys/rpc/svc.c
index ff25ee4..c6a70ea 100644
--- a/sys/rpc/svc.c
+++ b/sys/rpc/svc.c
@@ -75,6 +75,7 @@ static void svc_new_thread(SVCGROUP *grp);
 static void xprt_unregister_locked(SVCXPRT *xprt);
 static void svc_change_space_used(SVCPOOL *pool, long delta);
 static bool_t svc_request_space_available(SVCPOOL *pool);
+static void svcpool_cleanup(SVCPOOL *pool);
 
 /* ***************  SVCXPRT related stuff **************** */
 
@@ -174,8 +175,12 @@ svcpool_create(const char *name, struct sysctl_oid_list *sysctl_base)
 	return pool;
 }
 
-void
-svcpool_destroy(SVCPOOL *pool)
+/*
+ * Code common to svcpool_destroy() and svcpool_close(), which cleans up
+ * the pool data structures.
+ */
+static void
+svcpool_cleanup(SVCPOOL *pool)
 {
 	SVCGROUP *grp;
 	SVCXPRT *xprt, *nxprt;
@@ -211,6 +216,15 @@ svcpool_destroy(SVCPOOL *pool)
 		mtx_lock(&pool->sp_lock);
 	}
 	mtx_unlock(&pool->sp_lock);
+}
+
+void
+svcpool_destroy(SVCPOOL *pool)
+{
+	SVCGROUP *grp;
+	int g;
+
+	svcpool_cleanup(pool);
 
 	for (g = 0; g < SVC_MAXGROUPS; g++) {
 		grp = &pool->sp_groups[g];
@@ -226,6 +240,30 @@ svcpool_destroy(SVCPOOL *pool)
 }
 
 /*
+ * Similar to svcpool_destroy(), except that it does not destroy the actual
+ * data structures.  As such, "pool" may be used again.
+ */
+void
+svcpool_close(SVCPOOL *pool)
+{
+	SVCGROUP *grp;
+	int g;
+
+	svcpool_cleanup(pool);
+
+	/* Now, initialize the pool's state for a fresh svc_run() call. */
+	mtx_lock(&pool->sp_lock);
+	pool->sp_state = SVCPOOL_INIT;
+	mtx_unlock(&pool->sp_lock);
+	for (g = 0; g < SVC_MAXGROUPS; g++) {
+		grp = &pool->sp_groups[g];
+		mtx_lock(&grp->sg_lock);
+		grp->sg_state = SVCPOOL_ACTIVE;
+		mtx_unlock(&grp->sg_lock);
+	}
+}
+
+/*
  * Sysctl handler to get the present thread count on a pool
  */
 static int
diff --git a/sys/rpc/svc.h b/sys/rpc/svc.h
index 80285ec..2ecd1a9 100644
--- a/sys/rpc/svc.h
+++ b/sys/rpc/svc.h
@@ -729,6 +729,12 @@ extern SVCPOOL* svcpool_create(const char *name,
 extern void svcpool_destroy(SVCPOOL *pool);
 
 /*
+ * Close a service pool.  Similar to svcpool_destroy(), but it does not
+ * free the data structures.  As such, the pool can be used again.
+ */
+extern void svcpool_close(SVCPOOL *pool);
+
+/*
  * Transport independent svc_create routine.
  */
 extern int svc_create(SVCPOOL *, void (*)(struct svc_req *, SVCXPRT *),
diff --git a/sys/sys/syscallsubr.h b/sys/sys/syscallsubr.h
index e038c98..046e048 100644
--- a/sys/sys/syscallsubr.h
+++ b/sys/sys/syscallsubr.h
@@ -158,8 +158,8 @@ int	kern_mknod(struct thread *td, char *path, enum uio_seg pathseg,
 int	kern_mknodat(struct thread *td, int fd, char *path,
 	    enum uio_seg pathseg, int mode, int dev);
 int	kern_msgctl(struct thread *, int, int, struct msqid_ds *);
-int	kern_msgsnd(struct thread *, int, const void *, size_t, int, long);
 int	kern_msgrcv(struct thread *, int, void *, size_t, long, int, long *);
+int	kern_msgsnd(struct thread *, int, const void *, size_t, int, long);
 int     kern_nanosleep(struct thread *td, struct timespec *rqt,
 	    struct timespec *rmt);
 int	kern_ogetdirentries(struct thread *td, struct ogetdirentries_args *uap,
diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
index b4bf117..5ac0eee 100644
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -113,14 +113,8 @@ struct sbrk_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
-/* ARGSUSED */
 int
-sys_sbrk(td, uap)
-	struct thread *td;
-	struct sbrk_args *uap;
+sys_sbrk(struct thread *td, struct sbrk_args *uap)
 {
 	/* Not yet implemented */
 	return (EOPNOTSUPP);
@@ -132,14 +126,8 @@ struct sstk_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
-/* ARGSUSED */
 int
-sys_sstk(td, uap)
-	struct thread *td;
-	struct sstk_args *uap;
+sys_sstk(struct thread *td, struct sstk_args *uap)
 {
 	/* Not yet implemented */
 	return (EOPNOTSUPP);
@@ -153,11 +141,9 @@ struct getpagesize_args {
 #endif
 
 int
-ogetpagesize(td, uap)
-	struct thread *td;
-	struct getpagesize_args *uap;
+ogetpagesize(struct thread *td, struct getpagesize_args *uap)
 {
-	/* MP SAFE */
+
 	td->td_retval[0] = PAGE_SIZE;
 	return (0);
 }
@@ -189,9 +175,6 @@ struct mmap_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
 int
 sys_mmap(td, uap)
 	struct thread *td;
@@ -519,9 +502,6 @@ struct msync_args {
 	int flags;
 };
 #endif
-/*
- * MPSAFE
- */
 int
 sys_msync(td, uap)
 	struct thread *td;
@@ -574,9 +554,6 @@ struct munmap_args {
 	size_t len;
 };
 #endif
-/*
- * MPSAFE
- */
 int
 sys_munmap(td, uap)
 	struct thread *td;
@@ -650,9 +627,6 @@ struct mprotect_args {
 	int prot;
 };
 #endif
-/*
- * MPSAFE
- */
 int
 sys_mprotect(td, uap)
 	struct thread *td;
@@ -692,13 +666,8 @@ struct minherit_args {
 	int inherit;
 };
 #endif
-/*
- * MPSAFE
- */
 int
-sys_minherit(td, uap)
-	struct thread *td;
-	struct minherit_args *uap;
+sys_minherit(struct thread *td, struct minherit_args *uap)
 {
 	vm_offset_t addr;
 	vm_size_t size, pageoff;
@@ -733,13 +702,8 @@ struct madvise_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
 int
-sys_madvise(td, uap)
-	struct thread *td;
-	struct madvise_args *uap;
+sys_madvise(struct thread *td, struct madvise_args *uap)
 {
 	vm_offset_t start, end;
 	vm_map_t map;
@@ -791,13 +755,8 @@ struct mincore_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
 int
-sys_mincore(td, uap)
-	struct thread *td;
-	struct mincore_args *uap;
+sys_mincore(struct thread *td, struct mincore_args *uap)
 {
 	vm_offset_t addr, first_addr;
 	vm_offset_t end, cend;
@@ -1050,13 +1009,8 @@ struct mlock_args {
 	size_t len;
 };
 #endif
-/*
- * MPSAFE
- */
 int
-sys_mlock(td, uap)
-	struct thread *td;
-	struct mlock_args *uap;
+sys_mlock(struct thread *td, struct mlock_args *uap)
 {
 
 	return (vm_mlock(td->td_proc, td->td_ucred, uap->addr, uap->len));
@@ -1122,13 +1076,8 @@ struct mlockall_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
 int
-sys_mlockall(td, uap)
-	struct thread *td;
-	struct mlockall_args *uap;
+sys_mlockall(struct thread *td, struct mlockall_args *uap)
 {
 	vm_map_t map;
 	int error;
@@ -1199,13 +1148,8 @@ struct munlockall_args {
 };
 #endif
 
-/*
- * MPSAFE
- */
 int
-sys_munlockall(td, uap)
-	struct thread *td;
-	struct munlockall_args *uap;
+sys_munlockall(struct thread *td, struct munlockall_args *uap)
 {
 	vm_map_t map;
 	int error;
@@ -1240,9 +1184,6 @@ struct munlock_args {
 	size_t len;
 };
 #endif
-/*
- * MPSAFE
- */
 int
 sys_munlock(td, uap)
 	struct thread *td;
@@ -1397,8 +1338,6 @@ done:
 /*
  * vm_mmap_cdev()
  *
- * MPSAFE
- *
  * Helper function for vm_mmap.  Perform sanity check specific for mmap
  * operations on cdevs.
  */