--- a/exception_lists/copyright	Fri Nov 08 17:08:44 2019 +0100
+++ b/exception_lists/copyright	Thu Nov 14 23:30:04 2019 +0000
@@ -435,6 +435,7 @@
 usr/src/uts/common/gssapi/mechs/krb5/mech/util_seqnum.c
 usr/src/uts/common/gssapi/mechs/krb5/mech/val_cred.c
 usr/src/uts/common/io/cxgbe/*
+usr/src/uts/common/io/i40e/core/*
 usr/src/uts/common/io/iwn/THIRDPARTYLICENSE
 usr/src/uts/common/io/iwn/THIRDPARTYLICENSE.descrip
 usr/src/uts/common/io/iwn/fw-iw/THIRDPARTYLICENSE

--- a/exception_lists/wscheck	Fri Nov 08 17:08:44 2019 +0100
+++ b/exception_lists/wscheck	Thu Nov 14 23:30:04 2019 +0000
@@ -12,12 +12,13 @@
 #
 syntax: glob
 
-usr/src/uts/common/io/qede/*
-usr/src/tools/smatch/src/*
+usr/src/cmd/smbsrv/testoplock/case*.ref
 usr/src/data/hwdata/pci.ids
 usr/src/data/hwdata/usb.ids
 usr/src/data/perfmon/readme.txt
-usr/src/cmd/smbsrv/testoplock/case*.ref
+usr/src/tools/smatch/src/*
+usr/src/uts/common/io/qede/*
+usr/src/uts/common/io/i40e/core/*
 
 usr/src/data/ucode/amd/*
 usr/src/data/ucode/intel/*

--- a/usr/src/boot/Makefile.version	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/boot/Makefile.version	Thu Nov 14 23:30:04 2019 +0000
@@ -33,4 +33,4 @@
 # Use date like formatting here, YYYY.MM.DD.XX, without leading zeroes.
 # The version is processed from left to right, the version number can only
 # be increased.
-BOOT_VERSION = $(LOADER_VERSION)-2019.11.04.1
+BOOT_VERSION = $(LOADER_VERSION)-2019.11.06.1

--- a/usr/src/boot/lib/libstand/zfs/zfs.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/boot/lib/libstand/zfs/zfs.c	Thu Nov 14 23:30:04 2019 +0000
@@ -51,12 +51,12 @@
 #define		ZFS_BE_FIRST	4
 #define		ZFS_BE_LAST	8
 
-static int	zfs_open(const char *path, struct open_file *f);
-static int	zfs_close(struct open_file *f);
-static int	zfs_read(struct open_file *f, void *buf, size_t size, size_t *resid);
-static off_t	zfs_seek(struct open_file *f, off_t offset, int where);
-static int	zfs_stat(struct open_file *f, struct stat *sb);
-static int	zfs_readdir(struct open_file *f, struct dirent *d);
+static int	zfs_open(const char *, struct open_file *);
+static int	zfs_close(struct open_file *);
+static int	zfs_read(struct open_file *, void *, size_t, size_t *);
+static off_t	zfs_seek(struct open_file *, off_t, int);
+static int	zfs_stat(struct open_file *, struct stat *);
+static int	zfs_readdir(struct open_file *, struct dirent *);
 
 struct devsw zfs_dev;
 
@@ -82,12 +82,8 @@
 	zap_leaf_phys_t	*f_zap_leaf;	/* zap leaf buffer */
 };
 
-#ifdef __FreeBSD__
-static int	zfs_env_index;
-static int	zfs_env_count;
-#endif
-
-SLIST_HEAD(zfs_be_list, zfs_be_entry) zfs_be_head = SLIST_HEAD_INITIALIZER(zfs_be_head);
+SLIST_HEAD(zfs_be_list, zfs_be_entry) zfs_be_head =
+    SLIST_HEAD_INITIALIZER(zfs_be_head);
 struct zfs_be_list *zfs_be_headp;
 struct zfs_be_entry {
 	const char *name;
@@ -139,7 +135,7 @@
  * Cross block boundaries when necessary.
  */
 static int
-zfs_read(struct open_file *f, void *start, size_t size, size_t *resid	/* out */)
+zfs_read(struct open_file *f, void *start, size_t size, size_t *resid)
 {
 	const spa_t *spa = ((struct zfsmount *)f->f_devdata)->spa;
 	struct file *fp = (struct file *)f->f_fsdata;
@@ -158,11 +154,6 @@
 	if (rc)
 		return (rc);
 
-	if (0) {
-	    int i;
-	    for (i = 0; i < n; i++)
-		putchar(((char*) start)[i]);
-	}
 	fp->f_seekp += n;
 	if (resid)
 		*resid = size - n;
@@ -174,6 +165,9 @@
 zfs_seek(struct open_file *f, off_t offset, int where)
 {
 	struct file *fp = (struct file *)f->f_fsdata;
+	struct stat sb;
+	int error;
+
 
 	switch (where) {
 	case SEEK_SET:
@@ -183,10 +177,6 @@
 		fp->f_seekp += offset;
 		break;
 	case SEEK_END:
-	    {
-		struct stat sb;
-		int error;
-
 		error = zfs_stat(f, &sb);
 		if (error != 0) {
 			errno = error;
@@ -194,7 +184,6 @@
 		}
 		fp->f_seekp = sb.st_size - offset;
 		break;
-	    }
 	default:
 		errno = EINVAL;
 		return (-1);
@@ -231,8 +220,8 @@
 	 * If this is the first read, get the zap type.
 	 */
 	if (fp->f_seekp == 0) {
-		rc = dnode_read(spa, &fp->f_dnode,
-				0, &fp->f_zap_type, sizeof(fp->f_zap_type));
+		rc = dnode_read(spa, &fp->f_dnode, 0, &fp->f_zap_type,
+		    sizeof (fp->f_zap_type));
 		if (rc)
 			return (rc);
 
@@ -240,9 +229,8 @@
 			fp->f_seekp = offsetof(mzap_phys_t, mz_chunk);
 		} else {
 			rc = dnode_read(spa, &fp->f_dnode,
-					offsetof(zap_phys_t, zap_num_leafs),
-					&fp->f_num_leafs,
-					sizeof(fp->f_num_leafs));
+			    offsetof(zap_phys_t, zap_num_leafs),
+			    &fp->f_num_leafs, sizeof (fp->f_num_leafs));
 			if (rc)
 				return (rc);
 
@@ -250,10 +238,8 @@
 			fp->f_zap_leaf = malloc(bsize);
 			if (fp->f_zap_leaf == NULL)
 				return (ENOMEM);
-			rc = dnode_read(spa, &fp->f_dnode,
-					fp->f_seekp,
-					fp->f_zap_leaf,
-					bsize);
+			rc = dnode_read(spa, &fp->f_dnode, fp->f_seekp,
+			    fp->f_zap_leaf, bsize);
 			if (rc)
 				return (rc);
 		}
@@ -264,11 +250,11 @@
 		if (fp->f_seekp >= bsize)
 			return (ENOENT);
 
-		rc = dnode_read(spa, &fp->f_dnode,
-				fp->f_seekp, &mze, sizeof(mze));
+		rc = dnode_read(spa, &fp->f_dnode, fp->f_seekp, &mze,
+		    sizeof (mze));
 		if (rc)
 			return (rc);
-		fp->f_seekp += sizeof(mze);
+		fp->f_seekp += sizeof (mze);
 
 		if (!mze.mze_name[0])
 			goto mzap_next;
@@ -310,10 +296,8 @@
 			if (fp->f_seekp >= bsize * fp->f_num_leafs)
 				return (ENOENT);
 
-			rc = dnode_read(spa, &fp->f_dnode,
-					fp->f_seekp,
-					fp->f_zap_leaf,
-					bsize);
+			rc = dnode_read(spa, &fp->f_dnode, fp->f_seekp,
+			    fp->f_zap_leaf, bsize);
 			if (rc)
 				return (rc);
 		}
@@ -324,8 +308,8 @@
 			goto fzap_next;
 
 		namelen = zc->l_entry.le_name_numints;
-		if (namelen > sizeof(d->d_name))
-			namelen = sizeof(d->d_name);
+		if (namelen > sizeof (d->d_name))
+			namelen = sizeof (d->d_name);
 
 		/*
 		 * Paste the name back together.
@@ -342,7 +326,7 @@
 			namelen -= len;
 			nc = &ZAP_LEAF_CHUNK(&zl, nc->l_array.la_next);
 		}
-		d->d_name[sizeof(d->d_name) - 1] = 0;
+		d->d_name[sizeof (d->d_name) - 1] = 0;
 
 		/*
 		 * Assume the first eight bytes of the value are
@@ -363,57 +347,107 @@
     size_t bytes)
 {
 	int fd, ret;
-	size_t res, size, remainder, rb_size, blksz;
-	unsigned secsz;
-	off_t off;
-	char *bouncebuf, *rb_buf;
+	size_t res, head, tail, total_size, full_sec_size;
+	unsigned secsz, do_tail_read;
+	off_t start_sec;
+	char *outbuf, *bouncebuf;
 
-	fd = (uintptr_t) priv;
+	fd = (uintptr_t)priv;
+	outbuf = (char *)buf;
 	bouncebuf = NULL;
 
 	ret = ioctl(fd, DIOCGSECTORSIZE, &secsz);
 	if (ret != 0)
 		return (ret);
 
-	off = offset / secsz;
-	remainder = offset % secsz;
-	if (lseek(fd, off * secsz, SEEK_SET) == -1)
-		return (errno);
+	/*
+	 * Handling reads of arbitrary offset and size - multi-sector case
+	 * and single-sector case.
+	 *
+	 *                        Multi-sector Case
+	 *                (do_tail_read = true if tail > 0)
+	 *
+	 *   |<----------------------total_size--------------------->|
+	 *   |                                                       |
+	 *   |<--head-->|<--------------bytes------------>|<--tail-->|
+	 *   |          |                                 |          |
+	 *   |          |       |<~full_sec_size~>|       |          |
+	 *   +------------------+                 +------------------+
+	 *   |          |0101010|     .  .  .     |0101011|          |
+	 *   +------------------+                 +------------------+
+	 *         start_sec                         start_sec + n
+	 *
+	 *
+	 *                      Single-sector Case
+	 *                    (do_tail_read = false)
+	 *
+	 *              |<------total_size = secsz----->|
+	 *              |                               |
+	 *              |<-head->|<---bytes--->|<-tail->|
+	 *              +-------------------------------+
+	 *              |        |0101010101010|        |
+	 *              +-------------------------------+
+	 *                          start_sec
+	 */
+	start_sec = offset / secsz;
+	head = offset % secsz;
+	total_size = roundup2(head + bytes, secsz);
+	tail = total_size - (head + bytes);
+	do_tail_read = ((tail > 0) && (head + bytes > secsz));
+	full_sec_size = total_size;
+	if (head > 0)
+		full_sec_size -= secsz;
+	if (do_tail_read)
+		full_sec_size -= secsz;
 
-	rb_buf = buf;
-	rb_size = bytes;
-	size = roundup2(bytes + remainder, secsz);
-	blksz = size;
-	if (remainder != 0 || size != bytes) {
-		bouncebuf = zfs_alloc(secsz);
+	/* Return of partial sector data requires a bounce buffer. */
+	if ((head > 0) || do_tail_read) {
+		bouncebuf = malloc(secsz);
 		if (bouncebuf == NULL) {
 			printf("vdev_read: out of memory\n");
 			return (ENOMEM);
 		}
-		rb_buf = bouncebuf;
-		blksz = rb_size - remainder;
 	}
 
-	while (bytes > 0) {
-		res = read(fd, rb_buf, rb_size);
-		if (res != rb_size) {
+	if (lseek(fd, start_sec * secsz, SEEK_SET) == -1) {
+		ret = errno;
+		goto error;
+	}
+
+	/* Partial data return from first sector */
+	if (head > 0) {
+		res = read(fd, bouncebuf, secsz);
+		if (res != secsz) {
 			ret = EIO;
 			goto error;
 		}
-		if (bytes < blksz)
-			blksz = bytes;
-		if (bouncebuf != NULL)
-			memcpy(buf, rb_buf + remainder, blksz);
-		buf = (void *)((uintptr_t)buf + blksz);
-		bytes -= blksz;
-		remainder = 0;
-		blksz = rb_size;
+		memcpy(outbuf, bouncebuf + head, min(secsz - head, bytes));
+		outbuf += min(secsz - head, bytes);
+	}
+
+	/* Full data return from read sectors */
+	if (full_sec_size > 0) {
+		res = read(fd, outbuf, full_sec_size);
+		if (res != full_sec_size) {
+			ret = EIO;
+			goto error;
+		}
+		outbuf += full_sec_size;
+	}
+
+	/* Partial data return from last sector */
+	if (do_tail_read) {
+		res = read(fd, bouncebuf, secsz);
+		if (res != secsz) {
+			ret = EIO;
+			goto error;
+		}
+		memcpy(outbuf, bouncebuf, secsz - tail);
 	}
 
 	ret = 0;
 error:
-	if (bouncebuf != NULL)
-		zfs_free(bouncebuf, secsz);
+	free(bouncebuf);
 	return (ret);
 }
 
@@ -449,7 +483,7 @@
 	int		fd;
 	const char	*devname;
 	uint64_t	*pool_guid;
-	u_int		secsz;
+	unsigned	secsz;
 };
 
 static int
@@ -762,7 +796,7 @@
 	 * the environment and we can stop caring about old kernels,
 	 * we can remove this part.
 	 */
-	snprintf(buf, sizeof(buf), "zfs-bootfs=%s/%" PRIu64, spa->spa_name,
+	snprintf(buf, sizeof (buf), "zfs-bootfs=%s/%" PRIu64, spa->spa_name,
 	    objnum);
 	n = strlen(buf);
 	if (spa->spa_boot_vdev->v_phys_path != NULL) {

--- a/usr/src/boot/lib/libstand/zfs/zfsimpl.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/boot/lib/libstand/zfs/zfsimpl.c	Thu Nov 14 23:30:04 2019 +0000
@@ -1106,6 +1106,7 @@
 	const unsigned char *kids;
 	int nkids, i, is_new;
 	uint64_t is_offline, is_faulted, is_degraded, is_removed, isnt_present;
+	uint64_t is_log;
 
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_GUID, DATA_TYPE_UINT64,
 	    NULL, &guid) ||
@@ -1129,6 +1130,7 @@
 	}
 
 	is_offline = is_removed = is_faulted = is_degraded = isnt_present = 0;
+	is_log = 0;
 
 	nvlist_find(nvlist, ZPOOL_CONFIG_OFFLINE, DATA_TYPE_UINT64, NULL,
 	    &is_offline);
@@ -1140,6 +1142,8 @@
 	    &is_degraded);
 	nvlist_find(nvlist, ZPOOL_CONFIG_NOT_PRESENT, DATA_TYPE_UINT64, NULL,
 	    &isnt_present);
+	nvlist_find(nvlist, ZPOOL_CONFIG_IS_LOG, DATA_TYPE_UINT64, NULL,
+	    &is_log);
 
 	vdev = vdev_find(guid);
 	if (!vdev) {
@@ -1226,6 +1230,7 @@
 				return (ENOMEM);
 			vdev->v_name = name;
 		}
+		vdev->v_islog = is_log == 1;
 	} else {
 		is_new = 0;
 	}
@@ -1429,6 +1434,12 @@
 {
 	vdev_t *kid;
 	int ret;
+
+	if (vdev->v_islog) {
+		(void)pager_output("        logs\n");
+		indent++;
+	}
+
 	ret = print_state(indent, vdev->v_name, vdev->v_state);
 	if (ret != 0)
 		return (ret);
@@ -1534,32 +1545,171 @@
 }
 
 static int
+vdev_uberblock_compare(const uberblock_t *ub1, const uberblock_t *ub2)
+{
+	unsigned int seq1 = 0;
+	unsigned int seq2 = 0;
+	int cmp = AVL_CMP(ub1->ub_txg, ub2->ub_txg);
+
+	if (cmp != 0)
+		return (cmp);
+
+	cmp = AVL_CMP(ub1->ub_timestamp, ub2->ub_timestamp);
+	if (cmp != 0)
+		return (cmp);
+
+	if (MMP_VALID(ub1) && MMP_SEQ_VALID(ub1))
+		seq1 = MMP_SEQ(ub1);
+
+	if (MMP_VALID(ub2) && MMP_SEQ_VALID(ub2))
+		seq2 = MMP_SEQ(ub2);
+
+	return (AVL_CMP(seq1, seq2));
+}
+
+static int
+uberblock_verify(uberblock_t *ub)
+{
+	if (ub->ub_magic == BSWAP_64((uint64_t)UBERBLOCK_MAGIC)) {
+		byteswap_uint64_array(ub, sizeof (uberblock_t));
+	}
+
+	if (ub->ub_magic != UBERBLOCK_MAGIC ||
+	    !SPA_VERSION_IS_SUPPORTED(ub->ub_version))
+		return (EINVAL);
+
+	return (0);
+}
+
+static int
+vdev_label_read(vdev_t *vd, int l, void *buf, uint64_t offset,
+    size_t size)
+{
+	blkptr_t bp;
+	off_t off;
+
+	off = vdev_label_offset(vd->v_psize, l, offset);
+
+	BP_ZERO(&bp);
+	BP_SET_LSIZE(&bp, size);
+	BP_SET_PSIZE(&bp, size);
+	BP_SET_CHECKSUM(&bp, ZIO_CHECKSUM_LABEL);
+	BP_SET_COMPRESS(&bp, ZIO_COMPRESS_OFF);
+	DVA_SET_OFFSET(BP_IDENTITY(&bp), off);
+	ZIO_SET_CHECKSUM(&bp.blk_cksum, off, 0, 0, 0);
+
+	return (vdev_read_phys(vd, &bp, buf, off, size));
+}
+
+static unsigned char *
+vdev_label_read_config(vdev_t *vd, uint64_t txg)
+{
+	vdev_phys_t *label;
+	uint64_t best_txg = 0;
+	uint64_t label_txg = 0;
+	uint64_t asize;
+	unsigned char *nvl;
+	size_t nvl_size;
+	int error;
+
+	label = malloc(sizeof (vdev_phys_t));
+	if (label == NULL)
+		return (NULL);
+
+	nvl_size = VDEV_PHYS_SIZE - sizeof (zio_eck_t) - 4;
+	nvl = malloc(nvl_size);
+	if (nvl == NULL)
+		goto done;
+
+	for (int l = 0; l < VDEV_LABELS; l++) {
+		const unsigned char *nvlist;
+
+		if (vdev_label_read(vd, l, label,
+		    offsetof(vdev_label_t, vl_vdev_phys),
+		    sizeof (vdev_phys_t)))
+			continue;
+
+		if (label->vp_nvlist[0] != NV_ENCODE_XDR)
+			continue;
+
+		nvlist = (const unsigned char *) label->vp_nvlist + 4;
+		error = nvlist_find(nvlist, ZPOOL_CONFIG_POOL_TXG,
+		    DATA_TYPE_UINT64, NULL, &label_txg);
+		if (error != 0 || label_txg == 0) {
+			memcpy(nvl, nvlist, nvl_size);
+			goto done;
+		}
+
+		if (label_txg <= txg && label_txg > best_txg) {
+			best_txg = label_txg;
+			memcpy(nvl, nvlist, nvl_size);
+
+			/*
+			 * Use asize from pool config. We need this
+			 * because we can get bad value from BIOS.
+			 */
+			if (nvlist_find(nvlist, ZPOOL_CONFIG_ASIZE,
+			    DATA_TYPE_UINT64, NULL, &asize) == 0) {
+				vd->v_psize = asize +
+				    VDEV_LABEL_START_SIZE + VDEV_LABEL_END_SIZE;
+			}
+		}
+	}
+
+	if (best_txg == 0) {
+		free(nvl);
+		nvl = NULL;
+	}
+done:
+	free(label);
+	return (nvl);
+}
+
+static void
+vdev_uberblock_load(vdev_t *vd, uberblock_t *ub)
+{
+	uberblock_t *buf;
+
+	buf = malloc(VDEV_UBERBLOCK_SIZE(vd));
+	if (buf == NULL)
+		return;
+
+	for (int l = 0; l < VDEV_LABELS; l++) {
+		for (int n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
+			if (vdev_label_read(vd, l, buf,
+			    VDEV_UBERBLOCK_OFFSET(vd, n),
+			    VDEV_UBERBLOCK_SIZE(vd)))
+				continue;
+			if (uberblock_verify(buf) != 0)
+				continue;
+
+			if (vdev_uberblock_compare(buf, ub) > 0)
+				*ub = *buf;
+		}
+	}
+	free(buf);
+}
+
+static int
 vdev_probe(vdev_phys_read_t *phys_read, void *read_priv, spa_t **spap)
 {
 	vdev_t vtmp;
-	vdev_phys_t *vdev_label = (vdev_phys_t *) zap_scratch;
-	vdev_phys_t *tmp_label;
 	spa_t *spa;
 	vdev_t *vdev, *top_vdev, *pool_vdev;
-	off_t off;
-	blkptr_t bp;
-	const unsigned char *nvlist = NULL;
+	unsigned char *nvlist;
 	uint64_t val;
 	uint64_t guid;
-	uint64_t best_txg = 0;
 	uint64_t pool_txg, pool_guid;
 	const char *pool_name;
 	const unsigned char *vdevs;
 	const unsigned char *features;
-	int i, l, rc, is_newer;
-	char *upbuf;
-	const struct uberblock *up;
+	int rc, is_newer;
 
 	/*
 	 * Load the vdev label and figure out which
 	 * uberblock is most current.
 	 */
-	memset(&vtmp, 0, sizeof(vtmp));
+	memset(&vtmp, 0, sizeof (vtmp));
 	vtmp.v_phys_read = phys_read;
 	vtmp.v_read_priv = read_priv;
 	vtmp.v_psize = P2ALIGN(ldi_get_size(read_priv),
@@ -1569,67 +1719,20 @@
 	if (vtmp.v_psize < SPA_MINDEVSIZE)
 		return (EIO);
 
-	tmp_label = zfs_alloc(sizeof (vdev_phys_t));
-
-	for (l = 0; l < VDEV_LABELS; l++) {
-		off = vdev_label_offset(vtmp.v_psize, l,
-		    offsetof(vdev_label_t, vl_vdev_phys));
-
-		BP_ZERO(&bp);
-		BP_SET_LSIZE(&bp, sizeof(vdev_phys_t));
-		BP_SET_PSIZE(&bp, sizeof(vdev_phys_t));
-		BP_SET_CHECKSUM(&bp, ZIO_CHECKSUM_LABEL);
-		BP_SET_COMPRESS(&bp, ZIO_COMPRESS_OFF);
-		DVA_SET_OFFSET(BP_IDENTITY(&bp), off);
-		ZIO_SET_CHECKSUM(&bp.blk_cksum, off, 0, 0, 0);
-
-		if (vdev_read_phys(&vtmp, &bp, tmp_label, off, 0))
-			continue;
-
-		if (tmp_label->vp_nvlist[0] != NV_ENCODE_XDR)
-			continue;
-
-		nvlist = (const unsigned char *) tmp_label->vp_nvlist + 4;
-		if (nvlist_find(nvlist, ZPOOL_CONFIG_POOL_TXG,
-		    DATA_TYPE_UINT64, NULL, &pool_txg) != 0)
-			continue;
-
-		if (best_txg <= pool_txg) {
-			uint64_t asize;
-
-			best_txg = pool_txg;
-			memcpy(vdev_label, tmp_label, sizeof (vdev_phys_t));
-
-			/*
-			 * Use asize from pool config. We need this
-			 * because we can get bad value from BIOS.
-			 */
-			if (nvlist_find(nvlist, ZPOOL_CONFIG_ASIZE,
-			    DATA_TYPE_UINT64, NULL, &asize) == 0) {
-				vtmp.v_psize = asize +
-				    VDEV_LABEL_START_SIZE + VDEV_LABEL_END_SIZE;
-			}
-		}
-	}
-
-	zfs_free(tmp_label, sizeof (vdev_phys_t));
-
-	if (best_txg == 0)
+	nvlist = vdev_label_read_config(&vtmp, UINT64_MAX);
+	if (nvlist == NULL)
 		return (EIO);
 
-	if (vdev_label->vp_nvlist[0] != NV_ENCODE_XDR)
-		return (EIO);
-
-	nvlist = (const unsigned char *) vdev_label->vp_nvlist + 4;
-
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_VERSION, DATA_TYPE_UINT64,
 	    NULL, &val) != 0) {
+		free(nvlist);
 		return (EIO);
 	}
 
 	if (!SPA_VERSION_IS_SUPPORTED(val)) {
 		printf("ZFS: unsupported ZFS version %u (should be %u)\n",
 		    (unsigned) val, (unsigned) SPA_VERSION);
+		free(nvlist);
 		return (EIO);
 	}
 
@@ -1637,16 +1740,19 @@
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_FEATURES_FOR_READ,
 	    DATA_TYPE_NVLIST, NULL, &features) == 0 &&
 	    nvlist_check_features_for_read(features) != 0) {
+		free(nvlist);
 		return (EIO);
 	}
 
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_POOL_STATE, DATA_TYPE_UINT64,
 	    NULL, &val) != 0) {
+		free(nvlist);
 		return (EIO);
 	}
 
 	if (val == POOL_STATE_DESTROYED) {
 		/* We don't boot only from destroyed pools. */
+		free(nvlist);
 		return (EIO);
 	}
 
@@ -1660,12 +1766,7 @@
 		 * Cache and spare devices end up here - just ignore
 		 * them.
 		 */
-		/*printf("ZFS: can't find pool details\n");*/
-		return (EIO);
-	}
-
-	if (nvlist_find(nvlist, ZPOOL_CONFIG_IS_LOG, DATA_TYPE_UINT64,
-	    NULL, &val) == 0 && val != 0) {
+		free(nvlist);
 		return (EIO);
 	}
 
@@ -1675,8 +1776,10 @@
 	spa = spa_find_by_guid(pool_guid);
 	if (spa == NULL) {
 		spa = spa_create(pool_guid, pool_name);
-		if (spa == NULL)
+		if (spa == NULL) {
+			free(nvlist);
 			return (ENOMEM);
+		}
 	}
 	if (pool_txg > spa->spa_txg) {
 		spa->spa_txg = pool_txg;
@@ -1693,18 +1796,24 @@
 	 */
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_GUID, DATA_TYPE_UINT64,
 	    NULL, &guid) != 0) {
+		free(nvlist);
 		return (EIO);
 	}
 	vdev = vdev_find(guid);
-	if (vdev && vdev->v_phys_read)	/* Has this vdev already been inited? */
+	/* Has this vdev already been inited? */
+	if (vdev && vdev->v_phys_read) {
+		free(nvlist);
 		return (EIO);
+	}
 
 	if (nvlist_find(nvlist, ZPOOL_CONFIG_VDEV_TREE, DATA_TYPE_NVLIST,
 	    NULL, &vdevs)) {
+		free(nvlist);
 		return (EIO);
 	}
 
 	rc = vdev_init_from_nvlist(vdevs, NULL, &top_vdev, is_newer);
+	free(nvlist);
 	if (rc != 0)
 		return (rc);
 
@@ -1714,6 +1823,7 @@
 	STAILQ_FOREACH(pool_vdev, &spa->spa_vdevs, v_childlink)
 		if (top_vdev == pool_vdev)
 			break;
+
 	if (!pool_vdev && top_vdev) {
 		top_vdev->spa = spa;
 		STAILQ_INSERT_TAIL(&spa->spa_vdevs, top_vdev, v_childlink);
@@ -1734,6 +1844,9 @@
 		return (EIO);
 	}
 
+	if (vdev->v_islog)
+		spa->spa_with_log = vdev->v_islog;
+
 	/* Record boot vdev for spa. */
 	if (is_newer == 1)
 		spa->spa_boot_vdev = vdev;
@@ -1748,36 +1861,7 @@
 	 * the best uberblock and then we can actually access
 	 * the contents of the pool.
 	 */
-	upbuf = zfs_alloc(VDEV_UBERBLOCK_SIZE(vdev));
-	up = (const struct uberblock *)upbuf;
-	for (l = 0; l < VDEV_LABELS; l++) {
-		for (i = 0; i < VDEV_UBERBLOCK_COUNT(vdev); i++) {
-			off = vdev_label_offset(vdev->v_psize, l,
-			    VDEV_UBERBLOCK_OFFSET(vdev, i));
-			BP_ZERO(&bp);
-			DVA_SET_OFFSET(&bp.blk_dva[0], off);
-			BP_SET_LSIZE(&bp, VDEV_UBERBLOCK_SIZE(vdev));
-			BP_SET_PSIZE(&bp, VDEV_UBERBLOCK_SIZE(vdev));
-			BP_SET_CHECKSUM(&bp, ZIO_CHECKSUM_LABEL);
-			BP_SET_COMPRESS(&bp, ZIO_COMPRESS_OFF);
-			ZIO_SET_CHECKSUM(&bp.blk_cksum, off, 0, 0, 0);
-
-			if (vdev_read_phys(vdev, &bp, upbuf, off, 0) != 0)
-				continue;
-
-			if (up->ub_magic != UBERBLOCK_MAGIC)
-				continue;
-			if (up->ub_txg < spa->spa_txg)
-				continue;
-			if (up->ub_txg > spa->spa_uberblock.ub_txg ||
-			    (up->ub_txg == spa->spa_uberblock.ub_txg &&
-			    up->ub_timestamp >
-			    spa->spa_uberblock.ub_timestamp)) {
-				spa->spa_uberblock = *up;
-			}
-		}
-	}
-	zfs_free(upbuf, VDEV_UBERBLOCK_SIZE(vdev));
+	vdev_uberblock_load(vdev, &spa->spa_uberblock);
 
 	vdev->spa = spa;
 	if (spap != NULL)

--- a/usr/src/boot/sys/cddl/boot/zfs/zfsimpl.h	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/boot/sys/cddl/boot/zfs/zfsimpl.h	Thu Nov 14 23:30:04 2019 +0000
@@ -66,6 +66,14 @@
 
 #define _NOTE(s)
 
+/*
+ * AVL comparator helpers
+ */
+#define	AVL_ISIGN(a)	(((a) > 0) - ((a) < 0))
+#define	AVL_CMP(a, b)	(((a) > (b)) - ((a) < (b)))
+#define	AVL_PCMP(a, b)	\
+	(((uintptr_t)(a) > (uintptr_t)(b)) - ((uintptr_t)(a) < (uintptr_t)(b)))
+
 /* CRC64 table */
 #define	ZFS_CRC64_POLY	0xC96C5795D7870F42ULL	/* ECMA-182, reflected form */
 
@@ -492,8 +500,16 @@
 #define	VDEV_PHYS_SIZE		(112 << 10)
 #define	VDEV_UBERBLOCK_RING	(128 << 10)
 
+/*
+ * MMP blocks occupy the last MMP_BLOCKS_PER_LABEL slots in the uberblock
+ * ring when MMP is enabled.
+ */
+#define	MMP_BLOCKS_PER_LABEL	1
+
+/* The largest uberblock we support is 8k. */
+#define	MAX_UBERBLOCK_SHIFT	(13)
 #define	VDEV_UBERBLOCK_SHIFT(vd)	\
-	MAX((vd)->v_top->v_ashift, UBERBLOCK_SHIFT)
+	MIN(MAX((vd)->v_top->v_ashift, UBERBLOCK_SHIFT), MAX_UBERBLOCK_SHIFT)
 #define	VDEV_UBERBLOCK_COUNT(vd)	\
 	(VDEV_UBERBLOCK_RING >> VDEV_UBERBLOCK_SHIFT(vd))
 #define	VDEV_UBERBLOCK_OFFSET(vd, n)	\
@@ -843,15 +859,88 @@
  */
 #define	UBERBLOCK_MAGIC		0x00bab10c		/* oo-ba-bloc!	*/
 #define	UBERBLOCK_SHIFT		10			/* up to 1K	*/
+#define	MMP_MAGIC		0xa11cea11		/* all-see-all  */
 
-struct uberblock {
+#define	MMP_INTERVAL_VALID_BIT	0x01
+#define	MMP_SEQ_VALID_BIT	0x02
+#define	MMP_FAIL_INT_VALID_BIT	0x04
+
+#define	MMP_VALID(ubp)		(ubp->ub_magic == UBERBLOCK_MAGIC && \
+				    ubp->ub_mmp_magic == MMP_MAGIC)
+#define	MMP_INTERVAL_VALID(ubp)	(MMP_VALID(ubp) && (ubp->ub_mmp_config & \
+				    MMP_INTERVAL_VALID_BIT))
+#define	MMP_SEQ_VALID(ubp)	(MMP_VALID(ubp) && (ubp->ub_mmp_config & \
+				    MMP_SEQ_VALID_BIT))
+#define	MMP_FAIL_INT_VALID(ubp)	(MMP_VALID(ubp) && (ubp->ub_mmp_config & \
+				    MMP_FAIL_INT_VALID_BIT))
+
+#define	MMP_INTERVAL(ubp)	((ubp->ub_mmp_config & 0x00000000FFFFFF00) \
+				    >> 8)
+#define	MMP_SEQ(ubp)		((ubp->ub_mmp_config & 0x0000FFFF00000000) \
+				    >> 32)
+#define	MMP_FAIL_INT(ubp)	((ubp->ub_mmp_config & 0xFFFF000000000000) \
+				    >> 48)
+
+typedef struct uberblock {
 	uint64_t	ub_magic;	/* UBERBLOCK_MAGIC		*/
 	uint64_t	ub_version;	/* SPA_VERSION			*/
 	uint64_t	ub_txg;		/* txg of last sync		*/
 	uint64_t	ub_guid_sum;	/* sum of all vdev guids	*/
 	uint64_t	ub_timestamp;	/* UTC time of last sync	*/
 	blkptr_t	ub_rootbp;	/* MOS objset_phys_t		*/
-};
+	/* highest SPA_VERSION supported by software that wrote this txg */
+	uint64_t	ub_software_version;
+	/* Maybe missing in uberblocks we read, but always written */
+	uint64_t	ub_mmp_magic;
+	/*
+	 * If ub_mmp_delay == 0 and ub_mmp_magic is valid, MMP is off.
+	 * Otherwise, nanosec since last MMP write.
+	 */
+	uint64_t	ub_mmp_delay;
+
+	/*
+	 * The ub_mmp_config contains the multihost write interval, multihost
+	 * fail intervals, sequence number for sub-second granularity, and
+	 * valid bit mask.  This layout is as follows:
+	 *
+	 *   64      56      48      40      32      24      16      8       0
+	 *   +-------+-------+-------+-------+-------+-------+-------+-------+
+	 * 0 | Fail Intervals|      Seq      |   Write Interval (ms) | VALID |
+	 *   +-------+-------+-------+-------+-------+-------+-------+-------+
+	 *
+	 * This allows a write_interval of (2^24/1000)s, over 4.5 hours
+	 *
+	 * VALID Bits:
+	 * - 0x01 - Write Interval (ms)
+	 * - 0x02 - Sequence number exists
+	 * - 0x04 - Fail Intervals
+	 * - 0xf8 - Reserved
+	 */
+	uint64_t	ub_mmp_config;
+
+	/*
+	 * ub_checkpoint_txg indicates two things about the current uberblock:
+	 *
+	 * 1] If it is not zero then this uberblock is a checkpoint. If it is
+	 *    zero, then this uberblock is not a checkpoint.
+	 *
+	 * 2] On checkpointed uberblocks, the value of ub_checkpoint_txg is
+	 *    the ub_txg that the uberblock had at the time we moved it to
+	 *    the MOS config.
+	 *
+	 * The field is set when we checkpoint the uberblock and continues to
+	 * hold that value even after we've rewound (unlike the ub_txg that
+	 * is reset to a higher value).
+	 *
+	 * Besides checks used to determine whether we are reopening the
+	 * pool from a checkpointed uberblock [see spa_ld_select_uberblock()],
+	 * the value of the field is used to determine which ZIL blocks have
+	 * been allocated according to the ms_sm when we are rewinding to a
+	 * checkpoint. Specifically, if blk_birth > ub_checkpoint_txg, then
+	 * the ZIL block is not allocated [see uses of spa_min_claim_txg()].
+	 */
+	uint64_t	ub_checkpoint_txg;
+} uberblock_t;
 
 /*
  * Flags.
@@ -1681,6 +1770,7 @@
 	vdev_phys_read_t *v_phys_read;	/* read from raw leaf vdev */
 	vdev_read_t	*v_read;	/* read from vdev */
 	void		*v_read_priv;	/* private data for read function */
+	boolean_t	v_islog;
 	struct spa	*spa;		/* link to spa */
 	/*
 	 * Values stored in the config for an indirect or removing vdev.
@@ -1706,6 +1796,7 @@
 	void		*spa_cksum_tmpls[ZIO_CHECKSUM_FUNCTIONS];
 	int		spa_inited;	/* initialized */
 	vdev_t		*spa_boot_vdev;	/* boot device for kernel */
+	boolean_t	spa_with_log;	/* this pool has log */
 } spa_t;
 
 /* IO related arguments. */

--- a/usr/src/cmd/fm/modules/common/eversholt/eft_mdb.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/fm/modules/common/eversholt/eft_mdb.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,6 +22,8 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -316,8 +318,8 @@
 	if (argc) {
 		if (mdb_getopts(argc, argv,
 		    'l', MDB_OPT_UINT64, &ull,
-		    'p', MDB_OPT_SETBITS, TRUE, &opt_p,
-		    MDB_OPT_UINT64) != argc) {
+		    'p', MDB_OPT_SETBITS, TRUE, &opt_p, MDB_OPT_UINT64,
+		    NULL) != argc) {
 			return (DCMD_USAGE);
 		}
 	}

--- a/usr/src/cmd/idmap/idmapd/idmap_lsa.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/idmap/idmapd/idmap_lsa.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta Systems, Inc.  All rights reserved.
  */
 
 /*
@@ -83,9 +83,9 @@
 
 	(void) snprintf(sid, sizeof (sid), "%s-%u", sidprefix, rid);
 
-	rc = smb_lookup_sid(sid, &acct);
+	rc = smb_lookup_lsid(sid, &acct);
 	if (rc != 0) {
-		idmapdlog(LOG_ERR, "Error:  smb_lookup_sid failed.");
+		idmapdlog(LOG_ERR, "Error: SMB lookup SID failed.");
 		idmapdlog(LOG_ERR,
 		    "Check SMB service (svc:/network/smb/server).");
 		idmapdlog(LOG_ERR,
@@ -100,7 +100,7 @@
 	}
 	if (acct.a_status != NT_STATUS_SUCCESS) {
 		idmapdlog(LOG_WARNING,
-		    "Warning:  smb_lookup_sid(%s) failed (0x%x)",
+		    "Warning:  SMB lookup SID(%s) failed (0x%x)",
 		    sid, acct.a_status);
 		/* Fail soft */
 		ret = IDMAP_ERR_NOTFOUND;
@@ -167,9 +167,9 @@
 		goto out;
 	}
 
-	rc = smb_lookup_name(namedom, SidTypeUnknown, &acct);
+	rc = smb_lookup_lname(namedom, SidTypeUnknown, &acct);
 	if (rc != 0) {
-		idmapdlog(LOG_ERR, "Error:  smb_lookup_name failed.");
+		idmapdlog(LOG_ERR, "Error: SMB lookup name failed.");
 		idmapdlog(LOG_ERR,
 		    "Check SMB service (svc:/network/smb/server).");
 		idmapdlog(LOG_ERR,
@@ -183,7 +183,7 @@
 	}
 	if (acct.a_status != NT_STATUS_SUCCESS) {
 		idmapdlog(LOG_WARNING,
-		    "Warning:  smb_lookup_name(%s) failed (0x%x)",
+		    "Warning: SMB lookup name(%s) failed (0x%x)",
 		    namedom, acct.a_status);
 		/* Fail soft */
 		ret = IDMAP_ERR_NOTFOUND;

--- a/usr/src/cmd/mdb/common/mdb/mdb_modapi.h	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/mdb/mdb_modapi.h	Thu Nov 14 23:30:04 2019 +0000
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2013 by Delphix. All rights reserved.
- * Copyright (c) 2012 Joyent, Inc. All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #ifndef	_MDB_MODAPI_H
@@ -245,7 +245,7 @@
 #define	MDB_OPT_UINT64	5			/* uint64_t argument */
 #define	MDB_OPT_UINTPTR_SET	6		/* boolean_t+uintptr_t args */
 
-extern int mdb_getopts(int, const mdb_arg_t *, ...);
+extern int mdb_getopts(int, const mdb_arg_t *, ...) __sentinel(0);
 
 extern u_longlong_t mdb_strtoull(const char *);
 

--- a/usr/src/cmd/mdb/common/mdb/mdb_module_load.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/mdb/mdb_module_load.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
- * Copyright (c) 2012 Joyent, Inc. All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/param.h>
@@ -60,21 +60,22 @@
 		/*
 		 * Remove any .so(.[0-9]+)? suffix
 		 */
-		while ((p = strrchr(buf, '.')) != NULL) {
+		if ((p = strrchr(buf, '.')) != NULL) {
 			for (q = p + 1; isdigit(*q); q++)
 				;
 
 			if (*q == '\0') {
-				/* found digits to remove */
-				*p = '\0';
-				continue;
-			}
+				if (q > p + 1) {
 
-			if (strcmp(p, ".so") == 0) {
-				*p = '\0';
-				break;
+					/* found digits to remove */
+					*p = '\0';
+				}
 			}
-
+			if ((p = strrchr(buf, '.')) != NULL) {
+				if (strcmp(p, ".so") == 0) {
+					*p = '\0';
+				}
+			}
 		}
 		fullname = name;
 		name = buf;

--- a/usr/src/cmd/mdb/common/modules/cpc/cpc.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/cpc/cpc.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,6 +22,8 @@
 /*
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -57,7 +59,8 @@
 	int		j;
 	uint_t		opt_v = FALSE;
 
-	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &opt_v) != argc)
+	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &opt_v, NULL) !=
+	    argc)
 		return (DCMD_USAGE);
 
 	if ((flags & DCMD_ADDRSPEC) == 0) {

--- a/usr/src/cmd/mdb/common/modules/fctl/fctl.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/fctl/fctl.c	Thu Nov 14 23:30:04 2019 +0000
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2018, Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -134,7 +134,7 @@
 	}
 
 	if (mdb_getopts(argc, argv,
-	    'l', MDB_OPT_SETBITS, TRUE, &longlist) != argc) {
+	    'l', MDB_OPT_SETBITS, TRUE, &longlist, NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 
@@ -1104,7 +1104,8 @@
 
 	if (mdb_getopts(argc, argv,
 	    's', MDB_OPT_UINTPTR, &pktstart,
-	    'e', MDB_OPT_UINTPTR, &pktend) != argc) {
+	    'e', MDB_OPT_UINTPTR, &pktend,
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 

--- a/usr/src/cmd/mdb/common/modules/genunix/fm.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/genunix/fm.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,6 +21,8 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -158,7 +160,8 @@
 	if (!(flags & DCMD_ADDRSPEC))
 		return (DCMD_USAGE);
 
-	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &opt_v) != argc)
+	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &opt_v, NULL) !=
+	    argc)
 		return (DCMD_USAGE);
 
 	if (mdb_vread(&nvl, sizeof (nvl), addr) == -1) {

--- a/usr/src/cmd/mdb/common/modules/genunix/ldi.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/genunix/ldi.c	Thu Nov 14 23:30:04 2019 +0000
@@ -25,7 +25,7 @@
  */
 
 /*
- * Copyright (c) 2018, Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -290,7 +290,8 @@
 }
 
 static void
-ldi_handle_header(int refs, int ident) {
+ldi_handle_header(int refs, int ident)
+{
 	mdb_printf("%-?s ", "HANDLE");
 
 	if (refs)
@@ -369,7 +370,7 @@
 	int			refs = 1;
 
 	if (mdb_getopts(argc, argv,
-	    'i', MDB_OPT_SETBITS, TRUE, &ident) != argc)
+	    'i', MDB_OPT_SETBITS, TRUE, &ident, NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (ident)

--- a/usr/src/cmd/mdb/common/modules/genunix/memory.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/genunix/memory.c	Thu Nov 14 23:30:04 2019 +0000
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2018 Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <mdb/mdb_param.h>
@@ -695,7 +695,7 @@
 	if (mdb_getopts(argc, argv,
 	    'v', MDB_OPT_UINTPTR, &vp,
 	    'o', MDB_OPT_UINT64, &offset,
-	    0) != argc) {
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 

--- a/usr/src/cmd/mdb/common/modules/libumem/umem.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/libumem/umem.c	Thu Nov 14 23:30:04 2019 +0000
@@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2018, Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  * Copyright (c) 2013, 2015 by Delphix. All rights reserved.
  */
 
@@ -4089,7 +4089,7 @@
 	    'g', MDB_OPT_SETBITS, TRUE, &geometric,
 	    'b', MDB_OPT_UINTPTR, &maxbuckets,
 	    'B', MDB_OPT_UINTPTR, &minbucketsize,
-	    0) != argc)
+	    NULL) != argc)
 		return (DCMD_USAGE);
 
 	bzero(&mi, sizeof (mi));
@@ -4165,7 +4165,7 @@
 	    'g', MDB_OPT_SETBITS, TRUE, &geometric,
 	    'b', MDB_OPT_UINTPTR, &maxbuckets,
 	    'B', MDB_OPT_UINTPTR, &minbucketsize,
-	    0) != argc)
+	    NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (dump || geometric || (maxbuckets != 0) || (minbucketsize != 0))

--- a/usr/src/cmd/mdb/common/modules/pmcs/pmcs.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/pmcs/pmcs.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,6 +21,7 @@
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 Milan Jurik. All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <limits.h>
@@ -2646,7 +2647,8 @@
 	if (mdb_getopts(argc, argv,
 	    'i', MDB_OPT_UINT64, &index,
 	    's', MDB_OPT_UINT64, &snum,
-	    't', MDB_OPT_UINT64, &tag_type) != argc)
+	    't', MDB_OPT_UINT64, &tag_type,
+	    NULL) != argc)
 		return (DCMD_USAGE);
 
 	/*

--- a/usr/src/cmd/mdb/common/modules/qlc/qlc.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/qlc/qlc.c	Thu Nov 14 23:30:04 2019 +0000
@@ -34,6 +34,10 @@
  *
  */
 
+/*
+ * Copyright 2019 Joyent, Inc.
+ */
+
 #pragma ident	"Copyright 2015 QLogic Corporation; ql_mdb.c"
 
 #include <sys/mdb_modapi.h>
@@ -1115,8 +1119,8 @@
 		return (DCMD_USAGE);
 	}
 
-	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &verbose) !=
-	    argc) {
+	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &verbose,
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 
@@ -1750,8 +1754,8 @@
 		return (DCMD_USAGE);
 	}
 
-	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &verbose) !=
-	    argc) {
+	if (mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &verbose,
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 
@@ -3852,7 +3856,7 @@
 		return (DCMD_USAGE);
 	}
 
-	if (mdb_getopts(argc, argv) != argc) {
+	if (mdb_getopts(argc, argv, NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 

--- a/usr/src/cmd/mdb/common/modules/scsi_vhci/scsi_vhci.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/scsi_vhci/scsi_vhci.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,10 +21,10 @@
 /*
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2019 Joyent, Inc.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/kmem.h>
 #include <sys/proc.h>
 #include <sys/time.h>
@@ -193,10 +193,10 @@
 	dump_condvar(value.ct_failover_cv, "ct_failover_cv");
 
 	mdb_printf("\n");
-	mdb_printf("ct_failover_flags TEMP_VAR: %8d\n", value.ct_failover_flags)
-;
-	mdb_printf("ct_failover_status UNUSED: %9d\n", value.ct_failover_status)
-;
+	mdb_printf("ct_failover_flags TEMP_VAR: %8d\n",
+	    value.ct_failover_flags);
+	mdb_printf("ct_failover_status UNUSED: %9d\n",
+	    value.ct_failover_status);
 
 	return (DCMD_OK);
 }
@@ -250,7 +250,7 @@
 
 
 	if (flags & DCMD_ADDRSPEC)
-	    mdb_warn("This command doesn't use an address\n");
+		mdb_warn("This command doesn't use an address\n");
 
 	if (i_vhci_states(0, 0, 0, 0, &ss) != DCMD_OK)
 		return (DCMD_ERR);
@@ -517,7 +517,7 @@
 	}
 	if (sp == NULL) {
 		if (mdb_getopts(argc, argv,
-		    'v', MDB_OPT_SETBITS, TRUE, &verbose) != argc) {
+		    'v', MDB_OPT_SETBITS, TRUE, &verbose, NULL) != argc) {
 			return (DCMD_USAGE);
 		}
 	}

--- a/usr/src/cmd/mdb/common/modules/sctp/sctp.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/sctp/sctp.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -726,7 +727,8 @@
 	    'c', MDB_OPT_SETBITS, MDB_SCTP_SHOW_CLOSE, &opts,
 	    'e', MDB_OPT_SETBITS, MDB_SCTP_SHOW_EXT, &opts,
 	    'P', MDB_OPT_SETBITS, 1, &paddr,
-	    'd', MDB_OPT_SETBITS, MDB_SCTP_DUMP_ADDRS, &opts) != argc) {
+	    'd', MDB_OPT_SETBITS, MDB_SCTP_DUMP_ADDRS, &opts,
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 

--- a/usr/src/cmd/mdb/common/modules/smbsrv/smbsrv.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/smbsrv/smbsrv.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 #include <mdb/mdb_modapi.h>
@@ -1409,6 +1409,12 @@
 	{ "CHANGE_NOTIFY",
 	    SMB_USER_PRIV_CHANGE_NOTIFY,
 	    SMB_USER_PRIV_CHANGE_NOTIFY },
+	{ "READ_FILE",
+	    SMB_USER_PRIV_READ_FILE,
+	    SMB_USER_PRIV_READ_FILE },
+	{ "WRITE_FILE",
+	    SMB_USER_PRIV_WRITE_FILE,
+	    SMB_USER_PRIV_WRITE_FILE },
 	{ NULL, 0, 0 }
 };
 

--- a/usr/src/cmd/mdb/common/modules/sockfs/sockfs.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/sockfs/sockfs.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,6 +21,8 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -78,7 +80,7 @@
 		 */
 		if (mdb_getopts(argc, argv,
 		    'e', MDB_OPT_SETBITS, 1, &opt_e,
-		    'E', MDB_OPT_SETBITS, 1, &opt_E) != argc)
+		    'E', MDB_OPT_SETBITS, 1, &opt_E, NULL) != argc)
 			return (DCMD_USAGE);
 
 		if (!opt_E) {

--- a/usr/src/cmd/mdb/common/modules/zfs/zfs.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/common/modules/zfs/zfs.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,7 +22,7 @@
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
- * Copyright (c) 2019 Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 /* Portions Copyright 2010 Robert Milkowski */
@@ -948,7 +948,8 @@
 	    'n', MDB_OPT_STR, &data.osname,
 	    'o', MDB_OPT_STR, &object,
 	    'l', MDB_OPT_UINT64, &data.level,
-	    'b', MDB_OPT_STR, &blkid) != argc) {
+	    'b', MDB_OPT_STR, &blkid,
+	    NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 
@@ -3097,25 +3098,25 @@
 	return (WALK_NEXT);
 }
 
-typedef struct mdb_refcount {
+typedef struct mdb_zfs_refcount {
 	uint64_t rc_count;
-} mdb_refcount_t;
-
-typedef struct mdb_refcount_removed {
+} mdb_zfs_refcount_t;
+
+typedef struct mdb_zfs_refcount_removed {
 	uint64_t rc_removed_count;
-} mdb_refcount_removed_t;
-
-typedef struct mdb_refcount_tracked {
+} mdb_zfs_refcount_removed_t;
+
+typedef struct mdb_zfs_refcount_tracked {
 	boolean_t rc_tracked;
-} mdb_refcount_tracked_t;
+} mdb_zfs_refcount_tracked_t;
 
 /* ARGSUSED */
 static int
-refcount(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
+zfs_refcount(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 {
-	mdb_refcount_t rc;
-	mdb_refcount_removed_t rcr;
-	mdb_refcount_tracked_t rct;
+	mdb_zfs_refcount_t rc;
+	mdb_zfs_refcount_removed_t rcr;
+	mdb_zfs_refcount_tracked_t rct;
 	int off;
 	boolean_t released = B_FALSE;
 
@@ -3127,30 +3128,30 @@
 	    NULL) != argc)
 		return (DCMD_USAGE);
 
-	if (mdb_ctf_vread(&rc, "refcount_t", "mdb_refcount_t", addr,
+	if (mdb_ctf_vread(&rc, "zfs_refcount_t", "mdb_zfs_refcount_t", addr,
 	    0) == -1)
 		return (DCMD_ERR);
 
-	if (mdb_ctf_vread(&rcr, "refcount_t", "mdb_refcount_removed_t", addr,
-	    MDB_CTF_VREAD_QUIET) == -1) {
-		mdb_printf("refcount_t at %p has %llu holds (untracked)\n",
+	if (mdb_ctf_vread(&rcr, "zfs_refcount_t", "mdb_zfs_refcount_removed_t",
+	    addr, MDB_CTF_VREAD_QUIET) == -1) {
+		mdb_printf("zfs_refcount_t at %p has %llu holds (untracked)\n",
 		    addr, (longlong_t)rc.rc_count);
 		return (DCMD_OK);
 	}
 
-	if (mdb_ctf_vread(&rct, "refcount_t", "mdb_refcount_tracked_t", addr,
-	    MDB_CTF_VREAD_QUIET) == -1) {
+	if (mdb_ctf_vread(&rct, "zfs_refcount_t", "mdb_zfs_refcount_tracked_t",
+	    addr, MDB_CTF_VREAD_QUIET) == -1) {
 		/* If this is an old target, it might be tracked. */
 		rct.rc_tracked = B_TRUE;
 	}
 
-	mdb_printf("refcount_t at %p has %llu current holds, "
+	mdb_printf("zfs_refcount_t at %p has %llu current holds, "
 	    "%llu recently released holds\n",
 	    addr, (longlong_t)rc.rc_count, (longlong_t)rcr.rc_removed_count);
 
 	if (rct.rc_tracked && rc.rc_count > 0)
 		mdb_printf("current holds:\n");
-	off = mdb_ctf_offsetof_by_name("refcount_t", "rc_list");
+	off = mdb_ctf_offsetof_by_name("zfs_refcount_t", "rc_list");
 	if (off == -1)
 		return (DCMD_ERR);
 	mdb_pwalk("list", reference_cb, (void*)B_FALSE, addr + off);
@@ -3158,7 +3159,7 @@
 	if (released && rcr.rc_removed_count > 0) {
 		mdb_printf("released holds:\n");
 
-		off = mdb_ctf_offsetof_by_name("refcount_t", "rc_removed");
+		off = mdb_ctf_offsetof_by_name("zfs_refcount_t", "rc_removed");
 		if (off == -1)
 			return (DCMD_ERR);
 		mdb_pwalk("list", reference_cb, (void*)B_TRUE, addr + off);
@@ -3573,7 +3574,7 @@
 		return (DCMD_USAGE);
 
 	if (mdb_getopts(argc, argv,
-	    'v', MDB_OPT_SETBITS, TRUE, &verbose, TRUE, NULL) != argc)
+	    'v', MDB_OPT_SETBITS, TRUE, &verbose, NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (mdb_vread(&zacl, sizeof (zfs_acl_t), addr) == -1) {
@@ -3796,12 +3797,12 @@
 	}
 
 	mdb_printf("anonymous references:\n");
-	(void) mdb_call_dcmd("refcount", addr +
+	(void) mdb_call_dcmd("zfs_refcount", addr +
 	    mdb_ctf_offsetof_by_name(ZFS_STRUCT "rrwlock", "rr_anon_rcount"),
 	    DCMD_ADDRSPEC, 0, NULL);
 
 	mdb_printf("linked references:\n");
-	(void) mdb_call_dcmd("refcount", addr +
+	(void) mdb_call_dcmd("zfs_refcount", addr +
 	    mdb_ctf_offsetof_by_name(ZFS_STRUCT "rrwlock", "rr_linked_rcount"),
 	    DCMD_ADDRSPEC, 0, NULL);
 
@@ -4006,7 +4007,8 @@
 	    'a', MDB_OPT_SETBITS, ARC_CFLAG_ANON, &data.arc_cflags,
 	    'b', MDB_OPT_SETBITS, ARC_CFLAG_BUFS, &data.arc_cflags,
 	    'r', MDB_OPT_SETBITS, ARC_CFLAG_MRU, &data.arc_cflags,
-	    'f', MDB_OPT_SETBITS, ARC_CFLAG_MFU, &data.arc_cflags) != argc)
+	    'f', MDB_OPT_SETBITS, ARC_CFLAG_MFU, &data.arc_cflags,
+	    NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (mdb_lookup_by_obj(ZFS_OBJ_NAME, "ARC_anon", &data.anon_sym) ||
@@ -4343,9 +4345,9 @@
 	    "given a spa_t, print block type stats from last scrub",
 	    zfs_blkstats },
 	{ "zfs_params", "", "print zfs tunable parameters", zfs_params },
-	{ "refcount", ":[-r]\n"
+	{ "zfs_refcount", ":[-r]\n"
 	    "\t-r display recently removed references",
-	    "print refcount_t holders", refcount },
+	    "print zfs_refcount_t holders", zfs_refcount },
 	{ "zap_leaf", "", "print zap_leaf_phys_t", zap_leaf },
 	{ "zfs_aces", ":[-v]", "print all ACEs from a zfs_acl_t",
 	    zfs_acl_dump },

--- a/usr/src/cmd/mdb/i86pc/modules/unix/i86mmu.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/i86pc/modules/unix/i86mmu.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,7 +22,7 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright 2018 Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 /*
@@ -491,7 +491,7 @@
 		return (DCMD_USAGE);
 
 	if (mdb_getopts(argc, argv,
-	    'l', MDB_OPT_UINT64, &level) != argc)
+	    'l', MDB_OPT_UINT64, &level, NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (level > mmu.max_level) {
@@ -647,7 +647,7 @@
 		return (DCMD_ERR);
 
 	if (mdb_getopts(argc, argv,
-	    'a', MDB_OPT_STR, &addrspace_str) != argc)
+	    'a', MDB_OPT_STR, &addrspace_str, NULL) != argc)
 		return (DCMD_USAGE);
 
 	if ((flags & DCMD_ADDRSPEC) == 0)

--- a/usr/src/cmd/mdb/intel/modules/sata/sata.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/intel/modules/sata/sata.c	Thu Nov 14 23:30:04 2019 +0000
@@ -24,6 +24,7 @@
  */
 /*
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -216,7 +217,7 @@
 	}
 
 	if (mdb_getopts(argc, argv,
-	    'a', MDB_OPT_SETBITS, TRUE, &print_pathname) != argc) {
+	    'a', MDB_OPT_SETBITS, TRUE, &print_pathname, NULL) != argc) {
 		return (DCMD_USAGE);
 	}
 

--- a/usr/src/cmd/mdb/intel/modules/xhci/xhci.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/mdb/intel/modules/xhci/xhci.c	Thu Nov 14 23:30:04 2019 +0000
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2016 Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/mdb_modapi.h>
@@ -665,7 +665,7 @@
 
 	ep_set = slot_set = B_FALSE;
 	if (mdb_getopts(argc, argv, 'e', MDB_OPT_UINTPTR_SET, &ep_set, &ep,
-	    's', MDB_OPT_UINTPTR_SET, &slot_set, &slot) != argc)
+	    's', MDB_OPT_UINTPTR_SET, &slot_set, &slot, NULL) != argc)
 		return (DCMD_USAGE);
 
 	if (!slot_set) {

--- a/usr/src/cmd/ptools/Makefile.bld	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/ptools/Makefile.bld	Thu Nov 14 23:30:04 2019 +0000
@@ -24,7 +24,7 @@
 # Use is subject to license terms.
 # Copyright 2015 Joyent, Inc.
 #
-# Copyright (c) 2018, Joyent, Inc.
+# Copyright 2019 Joyent, Inc.
 
 PROG:sh = basename `cd ..; pwd`
 
@@ -128,6 +128,9 @@
 OBJS +=		$(OBJS_$(PROG))
 SRCS +=		$(SRCS_$(PROG))
 
+$(OBJS_ptree) :=	CSTD = $(CSTD_GNU99)
+ptree :=		CSTD = $(CSTD_GNU99)
+
 INSTALL_NEW=
 INSTALL_LEGACY=$(RM) $(ROOTPROCBINSYMLINK) ; \
 	$(LN) -s ../../bin/$(PROG) $(ROOTPROCBINSYMLINK)

--- a/usr/src/cmd/ptools/ptree/ptree.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/ptools/ptree/ptree.c	Thu Nov 14 23:30:04 2019 +0000
@@ -32,7 +32,9 @@
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
+#include <err.h>
 #include <fcntl.h>
+#include <sys/debug.h>
 #include <sys/types.h>
 #include <sys/termios.h>
 #include <unistd.h>
@@ -43,14 +45,17 @@
 #include <libzonecfg.h>
 #include <limits.h>
 #include <libcontract.h>
+#include <locale.h>
 #include <sys/contract.h>
 #include <sys/ctfs.h>
 #include <libcontract_priv.h>
 #include <sys/stat.h>
 #include <stdbool.h>
-#include "ptools_common.h"
 
+#define	COLUMN_DEFAULT	80
+#define	CHUNK_SIZE	256 /* Arbitrary amount */
 #define	FAKEDPID0(p)	(p->pid == 0 && p->psargs[0] == '\0')
+#define	HAS_SIBLING(p)	((p)->sp != NULL && (p)->sp->done != 0)
 
 typedef struct ps {
 	int	done;
@@ -70,6 +75,8 @@
 	struct ps *cp;		/* child */
 } ps_t;
 
+enum { DASH = 0, BAR, CORNER, VRIGHT };
+
 static	ps_t	**ps;		/* array of ps_t's */
 static	unsigned psize;		/* size of array */
 static	int	nps;		/* number of ps_t's */
@@ -79,17 +86,36 @@
 static	ps_t	*proc0;		/* process 0 */
 static	ps_t	*proc1;		/* process 1 */
 
-static	char	*command;
-
 static	int	aflag = 0;
 static	int	cflag = 0;
+static	int	gflag = 0;
 static	int	sflag = 0;
+static	int	wflag = 0;
 static	int	zflag = 0;
 static	zoneid_t zoneid;
 static	char *match_svc;
 static	char *match_inst;
-static	int	columns = 80;
+static	int	columns;
+
+static const char *box_ascii[] = {
+	[DASH] =	"-",
+	[BAR] =		"|",
+	[CORNER] =	"`",
+	[VRIGHT] =	"+"
+};
 
+static const char *box_utf8[] = {
+	[DASH] =	"\xe2\x94\x80", /* \u2500 */
+	[BAR] =		"\xe2\x94\x82", /* \u2502 */
+	[CORNER] =	"\xe2\x94\x94", /* \u2514 */
+	[VRIGHT] =	"\xe2\x94\x9c", /* \u251c */
+};
+
+static const char **box;
+
+static size_t get_termwidth(void);
+static const char **get_boxchars(void);
+static int add_proc(psinfo_t *, lwpsinfo_t *, void *);
 static bool match_proc(ps_t *);
 static void markprocs(ps_t *);
 static int printone(ps_t *, int);
@@ -101,32 +127,47 @@
 static zoneid_t getzone(const char *);
 static ps_t *fakepid0(void);
 
+static void *zalloc(size_t);
+static void *xreallocarray(void *, size_t, size_t);
+static char *xstrdup(const char *);
+
+static void __NORETURN
+usage(void)
+{
+	(void) fprintf(stderr,
+	    "usage:\t%s [-ac] [-s svc] [-z zone] [ {pid|user} ... ]\n",
+	    getprogname());
+	(void) fprintf(stderr,
+	    "  (show process trees)\n");
+	(void) fprintf(stderr,
+	    "  list can include process-ids and user names\n");
+	(void) fprintf(stderr,
+	    "  -a : include children of process 0\n");
+	(void) fprintf(stderr,
+	    "  -c : show contracts\n");
+	(void) fprintf(stderr,
+	    "  -g : use line drawing characters in output\n");
+	(void) fprintf(stderr,
+	    "  -s : print only processes with given service FMRI\n");
+	(void) fprintf(stderr,
+	    "  -w : allow lines to wrap instead of truncating\n");
+	(void) fprintf(stderr,
+	    "  -z : print only processes in given zone\n");
+	exit(2);
+}
+
 int
 main(int argc, char **argv)
 {
-	psinfo_t info;	/* process information structure from /proc */
 	int opt;
 	int errflg = 0;
-	struct winsize winsize;
-	char *s;
 	int n;
 	int retc = 0;
-	char ppath[PATH_MAX];
-
-	DIR *dirp;
-	struct dirent *dentp;
-	char	pname[PATH_MAX];
-	int	pdlen;
 
 	ps_t *p;
 
-	if ((command = strrchr(argv[0], '/')) == NULL)
-		command = argv[0];
-	else
-		command++;
-
 	/* options */
-	while ((opt = getopt(argc, argv, "acs:z:")) != EOF) {
+	while ((opt = getopt(argc, argv, "acgs:wz:")) != EOF) {
 		switch (opt) {
 		case 'a':		/* include children of process 0 */
 			aflag = 1;
@@ -134,10 +175,17 @@
 		case 'c':		/* display contract ownership */
 			aflag = cflag = 1;
 			break;
+		case 'g':
+			gflag = 1;
+			box = get_boxchars();
+			break;
 		case 's':
 			sflag = 1;
 			match_svc = parse_svc(optarg, &match_inst);
 			break;
+		case 'w':
+			wflag = 1;
+			break;
 		case 'z':		/* only processes in given zone */
 			zflag = 1;
 			zoneid = getzone(optarg);
@@ -151,132 +199,21 @@
 	argc -= optind;
 	argv += optind;
 
-	if (errflg) {
-		(void) fprintf(stderr,
-		    "usage:\t%s [-ac] [-s svc] [-z zone] [ {pid|user} ... ]\n",
-		    command);
-		(void) fprintf(stderr,
-		    "  (show process trees)\n");
-		(void) fprintf(stderr,
-		    "  list can include process-ids and user names\n");
-		(void) fprintf(stderr,
-		    "  -a : include children of process 0\n");
-		(void) fprintf(stderr,
-		    "  -c : show contracts\n");
-		(void) fprintf(stderr,
-		    "  -s : print only processes with given service FMRI\n");
-		(void) fprintf(stderr,
-		    "  -z : print only processes in given zone\n");
-		return (2);
+	if (errflg)
+		usage();
+
+	if (!wflag) {
+		columns = get_termwidth();
+		VERIFY3S(columns, >, 0);
 	}
 
-	/*
-	 * Kind of a hack to determine the width of the output...
-	 */
-	if ((s = getenv("COLUMNS")) != NULL && (n = atoi(s)) > 0)
-		columns = n;
-	else if (isatty(fileno(stdout)) &&
-	    ioctl(fileno(stdout), TIOCGWINSZ, &winsize) == 0 &&
-	    winsize.ws_col != 0)
-		columns = winsize.ws_col;
-
 	nps = 0;
 	psize = 0;
 	ps = NULL;
 
-	(void) proc_snprintf(ppath, sizeof (ppath), "/proc");
-
-	/*
-	 * Search the /proc directory for all processes.
-	 */
-	if ((dirp = opendir(ppath)) == NULL) {
-		(void) fprintf(stderr, "%s: cannot open %s directory\n",
-		    command, ppath);
-		return (1);
-	}
-
-	(void) strcpy(pname, ppath);
-	pdlen = strlen(pname);
-	pname[pdlen++] = '/';
-
-	/* for each active process --- */
-	while (dentp = readdir(dirp)) {
-		int	procfd;	/* filedescriptor for /proc/nnnnn/psinfo */
-
-		if (dentp->d_name[0] == '.')		/* skip . and .. */
-			continue;
-		(void) strcpy(pname + pdlen, dentp->d_name);
-		(void) strcpy(pname + strlen(pname), "/psinfo");
-retry:
-		if ((procfd = open(pname, O_RDONLY)) == -1)
-			continue;
-
-		/*
-		 * Get the info structure for the process and close quickly.
-		 */
-		if (read(procfd, &info, sizeof (info)) != sizeof (info)) {
-			int	saverr = errno;
-
-			(void) close(procfd);
-			if (saverr == EAGAIN)
-				goto retry;
-			if (saverr != ENOENT)
-				perror(pname);
-			continue;
-		}
-		(void) close(procfd);
+	/* Currently, this can only fail if the 3rd argument is invalid */
+	VERIFY0(proc_walk(add_proc, NULL, PR_WALK_PROC));
 
-		/*
-		 * We make sure there's always a free slot in the table
-		 * in case we need to add a fake p0.
-		 */
-		if (nps + 1 >= psize) {
-			if ((psize *= 2) == 0)
-				psize = 20;
-			if ((ps = realloc(ps, psize*sizeof (ps_t *))) == NULL) {
-				perror("realloc()");
-				return (1);
-			}
-		}
-		if ((p = calloc(1, sizeof (ps_t))) == NULL) {
-			perror("calloc()");
-			return (1);
-		}
-		ps[nps++] = p;
-		p->done = 0;
-		p->uid = info.pr_uid;
-		p->gid = info.pr_gid;
-		p->pid = info.pr_pid;
-		p->ppid = info.pr_ppid;
-		p->pgrp = info.pr_pgid;
-		p->sid = info.pr_sid;
-		p->zoneid = info.pr_zoneid;
-		p->ctid = info.pr_contract;
-		p->start = info.pr_start;
-		proc_unctrl_psinfo(&info);
-		if (info.pr_nlwp == 0)
-			(void) strcpy(p->psargs, "<defunct>");
-		else if (info.pr_psargs[0] == '\0')
-			(void) strncpy(p->psargs, info.pr_fname,
-			    sizeof (p->psargs));
-		else
-			(void) strncpy(p->psargs, info.pr_psargs,
-			    sizeof (p->psargs));
-		p->psargs[sizeof (p->psargs)-1] = '\0';
-		p->pp = NULL;
-		p->sp = NULL;
-		p->cp = NULL;
-
-		if (sflag)
-			p_get_svc_fmri(p, NULL);
-
-		if (p->pid == p->ppid)
-			proc0 = p;
-		if (p->pid == 1)
-			proc1 = p;
-	}
-
-	(void) closedir(dirp);
 	if (proc0 == NULL)
 		proc0 = fakepid0();
 	if (proc1 == NULL)
@@ -328,9 +265,7 @@
 		if (errno != 0 || *next != '\0') {
 			struct passwd *pw = getpwnam(arg);
 			if (pw == NULL) {
-				(void) fprintf(stderr,
-				    "%s: invalid username: %s\n",
-				    command, arg);
+				warnx("invalid username: %s", arg);
 				retc = 1;
 				continue;
 			}
@@ -372,7 +307,33 @@
 	return (retc || errflg);
 }
 
-#define	PIDWIDTH	5
+
+#define	PIDWIDTH	6
+
+static void
+printlines(ps_t *p, int level)
+{
+	if (level == 0)
+		return;
+
+	if (!gflag) {
+		(void) printf("%*s", level * 2, "");
+		return;
+	}
+
+	for (int i = 1; i < level; i++) {
+		ps_t *ancestor = p;
+
+		/* Find our ancestor at depth 'i' */
+		for (int j = i; j < level; j++)
+			ancestor = ancestor->pp;
+
+		(void) printf("%s ", HAS_SIBLING(ancestor) ? box[BAR] : " ");
+	}
+
+	(void) printf("%s%s", HAS_SIBLING(p) ? box[VRIGHT] : box[CORNER],
+	    box[DASH]);
+}
 
 static int
 printone(ps_t *p, int level)
@@ -381,15 +342,22 @@
 
 	if (p->done && !FAKEDPID0(p)) {
 		indent = level * 2;
-		if ((n = columns - PIDWIDTH - indent - 2) < 0)
-			n = 0;
+
+		if (wflag) {
+			n = strlen(p->psargs);
+		} else {
+			if ((n = columns - PIDWIDTH - indent - 2) < 0)
+				n = 0;
+		}
+
+		printlines(p, level);
 		if (p->pid >= 0) {
-			(void) printf("%*.*s%-*d %.*s\n", indent, indent, " ",
-			    PIDWIDTH, (int)p->pid, n, p->psargs);
+			(void) printf("%-*d %.*s\n", PIDWIDTH, (int)p->pid, n,
+			    p->psargs);
 		} else {
 			assert(cflag != 0);
-			(void) printf("%*.*s[process contract %d: %s]\n",
-			    indent, indent, " ", (int)p->ctid,
+			(void) printf("[process contract %d: %s]\n",
+			    (int)p->ctid,
 			    p->svc_fmri == NULL ? "?" : p->svc_fmri);
 		}
 		return (1);
@@ -476,18 +444,10 @@
 		return;
 
 	if (nctps >= ctsize) {
-		if ((ctsize *= 2) == 0)
-			ctsize = 20;
-		if ((ctps = realloc(ctps, ctsize * sizeof (ps_t *))) == NULL) {
-			perror("realloc()");
-			exit(1);
-		}
+		ctsize += CHUNK_SIZE;
+		ctps = xreallocarray(ctps, ctsize, sizeof (ps_t *));
 	}
-	pp = calloc(sizeof (ps_t), 1);
-	if (pp == NULL) {
-		perror("calloc()");
-		exit(1);
-	}
+	pp = zalloc(sizeof (*pp));
 	ctps[nctps++] = pp;
 
 	pp->pid = -1;
@@ -628,11 +588,7 @@
 	ps_t *p0, *p;
 	int n;
 
-	if ((p0 = calloc(1, sizeof (ps_t))) == NULL) {
-		perror("calloc()");
-		exit(1);
-	}
-	(void) memset(p0, '\0', sizeof (ps_t));
+	p0 = zalloc(sizeof (*p0));
 
 	/* First build all partial process trees. */
 	for (n = 0; n < nps; n++) {
@@ -659,10 +615,9 @@
 {
 	zoneid_t zoneid;
 
-	if (zone_get_id(arg, &zoneid) != 0) {
-		(void) fprintf(stderr, "%s: unknown zone: %s\n", command, arg);
-		exit(1);
-	}
+	if (zone_get_id(arg, &zoneid) != 0)
+		err(EXIT_FAILURE, "unknown zone: %s", arg);
+
 	return (zoneid);
 }
 
@@ -677,10 +632,7 @@
 	if (strncmp(p, "svc:/", strlen("svc:/")) == 0)
 		p += strlen("svc:/");
 
-	if ((ret = strdup(p)) == NULL) {
-		perror("strdup()");
-		exit(1);
-	}
+	ret = xstrdup(p);
 
 	if ((cp = strrchr(ret, ':')) != NULL) {
 		*cp = '\0';
@@ -689,10 +641,136 @@
 		cp = "";
 	}
 
-	if ((*instp = strdup(cp)) == NULL) {
-		perror("strdup()");
-		exit(1);
+	*instp = xstrdup(cp);
+	return (ret);
+}
+
+static int
+add_proc(psinfo_t *info, lwpsinfo_t *lwp __unused, void *arg __unused)
+{
+	ps_t *p;
+
+	/*
+	 * We make sure there is always a free slot in the table
+	 * in case we need to add a fake p0;
+	 */
+	if (nps + 1 >= psize) {
+		psize += CHUNK_SIZE;
+		ps = xreallocarray(ps, psize, sizeof (ps_t));
 	}
 
-	return (ret);
+	p = zalloc(sizeof (*p));
+	ps[nps++] = p;
+	p->done = 0;
+	p->uid = info->pr_uid;
+	p->gid = info->pr_gid;
+	p->pid = info->pr_pid;
+	p->ppid = info->pr_ppid;
+	p->pgrp = info->pr_pgid;
+	p->sid = info->pr_sid;
+	p->zoneid = info->pr_zoneid;
+	p->ctid = info->pr_contract;
+	p->start = info->pr_start;
+	proc_unctrl_psinfo(info);
+	if (info->pr_nlwp == 0)
+		(void) strcpy(p->psargs, "<defunct>");
+	else if (info->pr_psargs[0] == '\0')
+		(void) strncpy(p->psargs, info->pr_fname,
+		    sizeof (p->psargs));
+	else
+		(void) strncpy(p->psargs, info->pr_psargs,
+		    sizeof (p->psargs));
+	p->psargs[sizeof (p->psargs)-1] = '\0';
+	p->pp = NULL;
+	p->sp = NULL;
+
+	if (sflag)
+		p_get_svc_fmri(p, NULL);
+
+	if (p->pid == p->ppid)
+		proc0 = p;
+	if (p->pid == 1)
+		proc1 = p;
+
+	return (0);
 }
+
+
+static size_t
+get_termwidth(void)
+{
+	char *s;
+
+	if ((s = getenv("COLUMNS")) != NULL) {
+		unsigned long n;
+
+		errno = 0;
+		n = strtoul(s, NULL, 10);
+		if (n != 0 && errno == 0) {
+			/* Sanity check on the range */
+			if (n > INT_MAX)
+				n = COLUMN_DEFAULT;
+			return (n);
+		}
+	}
+
+	struct winsize winsize;
+
+	if (isatty(STDOUT_FILENO) &&
+	    ioctl(STDOUT_FILENO, TIOCGWINSZ, &winsize) == 0 &&
+	    winsize.ws_col != 0) {
+		return (winsize.ws_col);
+	}
+
+	return (COLUMN_DEFAULT);
+}
+
+static const char **
+get_boxchars(void)
+{
+	char *loc = setlocale(LC_ALL, "");
+
+	if (loc == NULL)
+		return (box_ascii);
+
+	const char *p = strstr(loc, "UTF-8");
+
+	/*
+	 * Only use the UTF-8 box drawing characters if the locale ends
+	 * with "UTF-8".
+	 */
+	if (p != NULL && p[5] == '\0')
+		return (box_utf8);
+
+	return (box_ascii);
+}
+
+static void *
+zalloc(size_t len)
+{
+	void *p = calloc(1, len);
+
+	if (p == NULL)
+		err(EXIT_FAILURE, "calloc");
+	return (p);
+}
+
+static void *
+xreallocarray(void *ptr, size_t nelem, size_t elsize)
+{
+	void *p = reallocarray(ptr, nelem, elsize);
+
+	if (p == NULL)
+		err(EXIT_FAILURE, "reallocarray");
+	return (p);
+}
+
+static char *
+xstrdup(const char *s)
+{
+	char *news = strdup(s);
+
+	if (news == NULL)
+		err(EXIT_FAILURE, "strdup");
+	return (news);
+}

--- a/usr/src/cmd/smbsrv/smbadm/smbadm.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/smbsrv/smbadm/smbadm.c	Thu Nov 14 23:30:04 2019 +0000
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -178,6 +178,10 @@
 static boolean_t smbadm_chkprop_priv(smbadm_prop_t *prop);
 static int smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop);
 static int smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop);
+static int smbadm_setprop_readfile(char *gname, smbadm_prop_t *prop);
+static int smbadm_getprop_readfile(char *gname, smbadm_prop_t *prop);
+static int smbadm_setprop_writefile(char *gname, smbadm_prop_t *prop);
+static int smbadm_getprop_writefile(char *gname, smbadm_prop_t *prop);
 static int smbadm_setprop_backup(char *gname, smbadm_prop_t *prop);
 static int smbadm_getprop_backup(char *gname, smbadm_prop_t *prop);
 static int smbadm_setprop_restore(char *gname, smbadm_prop_t *prop);
@@ -192,6 +196,10 @@
 	smbadm_getprop_restore,	smbadm_chkprop_priv	},
 	{"take-ownership", "on|off",	smbadm_setprop_tkowner,
 	smbadm_getprop_tkowner,	smbadm_chkprop_priv	},
+	{"bypass-read", "on|off",	smbadm_setprop_readfile,
+	smbadm_getprop_readfile,	smbadm_chkprop_priv	},
+	{"bypass-write", "on|off",	smbadm_setprop_writefile,
+	smbadm_getprop_writefile,	smbadm_chkprop_priv	},
 	{"description",	"<string>",	smbadm_setprop_desc,
 	smbadm_getprop_desc,	NULL			},
 };
@@ -1807,6 +1815,30 @@
 }
 
 static int
+smbadm_setprop_readfile(char *gname, smbadm_prop_t *prop)
+{
+	return (smbadm_group_setpriv(gname, SE_READ_FILE_LUID, prop));
+}
+
+static int
+smbadm_getprop_readfile(char *gname, smbadm_prop_t *prop)
+{
+	return (smbadm_group_getpriv(gname, SE_READ_FILE_LUID, prop));
+}
+
+static int
+smbadm_setprop_writefile(char *gname, smbadm_prop_t *prop)
+{
+	return (smbadm_group_setpriv(gname, SE_WRITE_FILE_LUID, prop));
+}
+
+static int
+smbadm_getprop_writefile(char *gname, smbadm_prop_t *prop)
+{
+	return (smbadm_group_getpriv(gname, SE_WRITE_FILE_LUID, prop));
+}
+
+static int
 smbadm_setprop_backup(char *gname, smbadm_prop_t *prop)
 {
 	return (smbadm_group_setpriv(gname, SE_BACKUP_LUID, prop));

--- a/usr/src/cmd/smbsrv/smbd/smbd_doorsvc.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/smbsrv/smbd/smbd_doorsvc.c	Thu Nov 14 23:30:04 2019 +0000
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta Systems, Inc.  All rights reserved.
  */
 
 #include <sys/list.h>
@@ -103,7 +103,9 @@
 	{ SMB_DR_DFS_GET_REFERRALS,	smbd_dop_dfs_get_referrals },
 	{ SMB_DR_SHR_HOSTACCESS,	smbd_dop_shr_hostaccess },
 	{ SMB_DR_SHR_EXEC,		smbd_dop_shr_exec },
-	{ SMB_DR_NOTIFY_DC_CHANGED,	smbd_dop_notify_dc_changed }
+	{ SMB_DR_NOTIFY_DC_CHANGED,	smbd_dop_notify_dc_changed },
+	{ SMB_DR_LOOKUP_LSID,		smbd_dop_lookup_sid },
+	{ SMB_DR_LOOKUP_LNAME,		smbd_dop_lookup_name }
 };
 
 static int smbd_ndoorop = (sizeof (smbd_doorops) / sizeof (smbd_doorops[0]));
@@ -581,6 +583,10 @@
 	return (SMB_DOP_EMPTYBUF);
 }
 
+/*
+ * SMB_DR_LOOKUP_NAME,
+ * SMB_DR_LOOKUP_LNAME (local-only, for idmap)
+ */
 static int
 smbd_dop_lookup_name(smbd_arg_t *arg)
 {
@@ -604,7 +610,24 @@
 		(void) snprintf(buf, MAXNAMELEN, "%s\\%s", acct.a_domain,
 		    acct.a_name);
 
-	acct.a_status = lsa_lookup_name(buf, acct.a_sidtype, &ainfo);
+	switch (arg->hdr.dh_op) {
+	case SMB_DR_LOOKUP_NAME:
+		acct.a_status = lsa_lookup_name(buf, acct.a_sidtype, &ainfo);
+		break;
+
+	case SMB_DR_LOOKUP_LNAME:
+		/*
+		 * Basically for idmap.  Don't call out to AD.
+		 */
+		acct.a_status = lsa_lookup_lname(buf, acct.a_sidtype, &ainfo);
+		break;
+
+	default:
+		assert(!"arg->hdr.dh_op");
+		acct.a_status = NT_STATUS_INTERNAL_ERROR;
+		break;
+	}
+
 	if (acct.a_status == NT_STATUS_SUCCESS) {
 		acct.a_sidtype = ainfo.a_type;
 		smb_sid_tostr(ainfo.a_sid, acct.a_sid);
@@ -626,6 +649,10 @@
 	return (SMB_DOP_SUCCESS);
 }
 
+/*
+ * SMB_DR_LOOKUP_SID,
+ * SMB_DR_LOOKUP_LSID (local-only, for idmap)
+ */
 static int
 smbd_dop_lookup_sid(smbd_arg_t *arg)
 {
@@ -641,7 +668,25 @@
 		return (SMB_DOP_DECODE_ERROR);
 
 	sid = smb_sid_fromstr(acct.a_sid);
-	acct.a_status = lsa_lookup_sid(sid, &ainfo);
+
+	switch (arg->hdr.dh_op) {
+	case SMB_DR_LOOKUP_SID:
+		acct.a_status = lsa_lookup_sid(sid, &ainfo);
+		break;
+
+	case SMB_DR_LOOKUP_LSID:
+		/*
+		 * Basically for idmap.  Don't call out to AD.
+		 */
+		acct.a_status = lsa_lookup_lsid(sid, &ainfo);
+		break;
+
+	default:
+		assert(!"arg->hdr.dh_op");
+		acct.a_status = NT_STATUS_INTERNAL_ERROR;
+		break;
+	}
+
 	smb_sid_free(sid);
 
 	if (acct.a_status == NT_STATUS_SUCCESS) {

--- a/usr/src/cmd/zdb/zdb.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/cmd/zdb/zdb.c	Thu Nov 14 23:30:04 2019 +0000
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
+ * Copyright (c) 2011, 2019 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  * Copyright 2017 Nexenta Systems, Inc.
  * Copyright (c) 2017, 2018 Lawrence Livermore National Security, LLC.
@@ -901,7 +901,7 @@
 	/* max sure nicenum has enough space */
 	CTASSERT(sizeof (maxbuf) >= NN_NUMBUF_SZ);
 
-	zdb_nicenum(metaslab_block_maxsize(msp), maxbuf, sizeof (maxbuf));
+	zdb_nicenum(metaslab_largest_allocatable(msp), maxbuf, sizeof (maxbuf));
 
 	(void) printf("\t %25s %10lu   %7s  %6s   %4s %4d%%\n",
 	    "segments", avl_numnodes(t), "maxsize", maxbuf,

--- a/usr/src/common/crypto/modes/modes.h	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/common/crypto/modes/modes.h	Thu Nov 14 23:30:04 2019 +0000
@@ -23,7 +23,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
- * Copyright (c) 2018, Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #ifndef	_COMMON_CRYPTO_MODES_H
@@ -51,6 +51,9 @@
 #define	GMAC_MODE			0x00000040
 #define	CMAC_MODE			0x00000080
 
+/* Private flag for pkcs11_softtoken */
+#define	P11_DECRYPTED			0x80000000
+
 /*
  * cc_keysched:		Pointer to key schedule.
  *

--- a/usr/src/data/zoneinfo/zone_sun.tab	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/data/zoneinfo/zone_sun.tab	Thu Nov 14 23:30:04 2019 +0000
@@ -133,7 +133,7 @@
 CA	+4612-05957	America/Glace_Bay	-	Atlantic - NS (Cape Breton)
 CA	+4606-06447	America/Moncton	-	Atlantic - New Brunswick
 CA	+5320-06025	America/Goose_Bay	-	Atlantic - Labrador (most areas)
-CA	+5125-05707	America/Blanc-Sablon	AST - QC (Lower North Shore)
+CA	+5125-05707	America/Blanc-Sablon	-	AST - QC (Lower North Shore)
 CA	+4339-07923	America/Toronto	-	Eastern - ON, QC (most areas)
 CA	+4901-08816	America/Nipigon	-	Eastern - ON, QC (no DST 1967-73)
 CA	+4823-08915	America/Thunder_Bay	-	Eastern - ON (Thunder Bay)

--- a/usr/src/lib/fm/topo/modules/common/fac_prov_ipmi/fac_prov_ipmi.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/lib/fm/topo/modules/common/fac_prov_ipmi/fac_prov_ipmi.c	Thu Nov 14 23:30:04 2019 +0000
@@ -24,6 +24,7 @@
  */
 /*
  * Copyright (c) 2019, Joyent, Inc.
+ * Copyright 2019 by Western Digital Corporation
  */
 #include <unistd.h>
 #include <stdio.h>
@@ -427,6 +428,13 @@
 		topo_mod_ipmi_rele(mod);
 		return (-1);
 	}
+	if (reading->isr_state_unavailable) {
+		topo_mod_dprintf(mod, "Unavailable sensor %s, sensor_num=%d\n",
+		    entity_refs[i], sensor_num);
+		strarr_free(mod, entity_refs, nelems);
+		topo_mod_ipmi_rele(mod);
+		return (-1);
+	}
 	strarr_free(mod, entity_refs, nelems);
 	topo_mod_ipmi_rele(mod);
 

--- a/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/lib/fm/topo/modules/common/ipmi/ipmi_enum.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2017, Joyent, Inc.
+ * Copyright 2019 by Western Digital Corporation
  */
 
 #include <assert.h>
@@ -30,7 +31,7 @@
 #include <sys/fm/protocol.h>
 #include <string.h>
 
-#define	TOPO_PGROUP_IPMI 		"ipmi"
+#define	TOPO_PGROUP_IPMI		"ipmi"
 #define	TOPO_PROP_IPMI_ENTITY_REF	"entity_ref"
 #define	TOPO_PROP_IPMI_ENTITY_PRESENT	"entity_present"
 #define	FAC_PROV_IPMI			"fac_prov_ipmi"
@@ -47,6 +48,8 @@
 
 static int ipmi_present(topo_mod_t *, tnode_t *, topo_version_t, nvlist_t *,
     nvlist_t **);
+static int ipmi_unusable(topo_mod_t *, tnode_t *, topo_version_t, nvlist_t *,
+    nvlist_t **);
 static int ipmi_enum(topo_mod_t *, tnode_t *, const char *,
     topo_instance_t, topo_instance_t, void *, void *);
 static int ipmi_post_process(topo_mod_t *, tnode_t *);
@@ -60,6 +63,9 @@
 static const topo_method_t ipmi_methods[] = {
 	{ TOPO_METH_PRESENT, TOPO_METH_PRESENT_DESC,
 	    TOPO_METH_PRESENT_VERSION0, TOPO_STABILITY_INTERNAL, ipmi_present },
+	{ TOPO_METH_UNUSABLE, TOPO_METH_UNUSABLE_DESC,
+	    TOPO_METH_UNUSABLE_VERSION, TOPO_STABILITY_INTERNAL,
+	    ipmi_unusable },
 	{ "ipmi_fru_label", "Property method", 0,
 	    TOPO_STABILITY_INTERNAL, ipmi_fru_label},
 	{ "ipmi_fru_fmri", "Property method", 0,
@@ -75,6 +81,85 @@
 const topo_modinfo_t ipmi_info =
 	{ "ipmi", FM_FMRI_SCHEME_HC, TOPO_VERSION, &ipmi_ops };
 
+/* Common code used by topo methods below to find an IPMI entity */
+static int
+ipmi_find_entity(topo_mod_t *mod, tnode_t *tn, ipmi_handle_t **ihpp,
+    ipmi_entity_t **epp, char **namep, ipmi_sdr_t **sdrpp)
+{
+	ipmi_handle_t *ihp;
+	ipmi_entity_t *ep;
+	int err;
+	char *name = NULL, **names;
+	ipmi_sdr_t *sdrp = NULL;
+	uint_t nelems, i;
+
+	*ihpp = NULL;
+	*epp = NULL;
+	*namep = NULL;
+	*sdrpp = NULL;
+
+	if ((ihp = topo_mod_ipmi_hold(mod)) == NULL)
+		return (topo_mod_seterrno(mod, ETOPO_METHOD_UNKNOWN));
+
+	ep = topo_node_getspecific(tn);
+	if (ep != NULL) {
+		*ihpp = ihp;
+		*epp = ep;
+		return (0);
+	}
+
+	if (topo_prop_get_string(tn, TOPO_PGROUP_IPMI,
+	    TOPO_PROP_IPMI_ENTITY_PRESENT, &name, &err) == 0) {
+		/*
+		 * Some broken IPMI implementations don't export correct
+		 * entities, so referring to an entity isn't sufficient.
+		 * For these platforms, we allow the XML to specify a
+		 * single SDR record that represents the current present
+		 * state.
+		 */
+		sdrp = ipmi_sdr_lookup(ihp, name);
+	} else {
+		if (topo_prop_get_string_array(tn, TOPO_PGROUP_IPMI,
+		    TOPO_PROP_IPMI_ENTITY_REF, &names, &nelems, &err) != 0) {
+			/*
+			 * Not all nodes have an entity_ref attribute.
+			 * For these cases, return ENOTSUP so that we
+			 * fall back to the default hc presence
+			 * detection.
+			 */
+			topo_mod_ipmi_rele(mod);
+			return (topo_mod_seterrno(mod, ETOPO_METHOD_NOTSUP));
+		}
+
+		for (i = 0; i < nelems; i++) {
+			if ((ep = ipmi_entity_lookup_sdr(ihp, names[i]))
+			    != NULL) {
+				name = names[i];
+				names[i] = NULL;
+				break;
+			}
+		}
+
+		for (i = 0; i < nelems; i++)
+			topo_mod_strfree(mod, names[i]);
+		topo_mod_free(mod, names, (nelems * sizeof (char *)));
+
+		if (ep == NULL) {
+			topo_mod_dprintf(mod,
+			    "Failed to get present state of %s=%d\n",
+			    topo_node_name(tn), topo_node_instance(tn));
+			topo_mod_ipmi_rele(mod);
+			return (-1);
+		}
+		topo_node_setspecific(tn, ep);
+	}
+
+	*ihpp = ihp;
+	*namep = name;
+	*sdrpp = sdrp;
+	return (0);
+}
+
 /*
  * Determine if the entity is present.
  */
@@ -85,81 +170,22 @@
 {
 	ipmi_handle_t *ihp;
 	ipmi_entity_t *ep;
-	boolean_t present;
-	nvlist_t *nvl;
-	int err, i;
-	char *name, **names;
+	char *name;
 	ipmi_sdr_t *sdrp;
-	uint_t nelems;
-
-	if ((ihp = topo_mod_ipmi_hold(mod)) == NULL)
-		return (topo_mod_seterrno(mod, ETOPO_METHOD_UNKNOWN));
-
-	ep = topo_node_getspecific(tn);
-	if (ep == NULL) {
-		if (topo_prop_get_string(tn, TOPO_PGROUP_IPMI,
-		    TOPO_PROP_IPMI_ENTITY_PRESENT, &name, &err) == 0) {
-			/*
-			 * Some broken IPMI implementations don't export correct
-			 * entities, so referring to an entity isn't sufficient.
-			 * For these platforms, we allow the XML to specify a
-			 * single SDR record that represents the current present
-			 * state.
-			 */
-			if ((sdrp = ipmi_sdr_lookup(ihp, name)) == NULL ||
-			    ipmi_entity_present_sdr(ihp, sdrp, &present) != 0) {
-				topo_mod_dprintf(mod,
-				    "Failed to get present state of %s (%s)\n",
-				    name, ipmi_errmsg(ihp));
-				topo_mod_strfree(mod, name);
-				topo_mod_ipmi_rele(mod);
-				return (-1);
-			}
+	int err;
+	boolean_t present = B_FALSE;
+	nvlist_t *nvl;
 
-			topo_mod_dprintf(mod,
-			    "ipmi_entity_present_sdr(%s) = %d\n", name,
-			    present);
-			topo_mod_strfree(mod, name);
-		} else {
-			if (topo_prop_get_string_array(tn, TOPO_PGROUP_IPMI,
-			    TOPO_PROP_IPMI_ENTITY_REF, &names, &nelems, &err)
-			    != 0) {
-				/*
-				 * Not all nodes have an entity_ref attribute.
-				 * For these cases, return ENOTSUP so that we
-				 * fall back to the default hc presence
-				 * detection.
-				 */
-				topo_mod_ipmi_rele(mod);
-				return (topo_mod_seterrno(mod,
-				    ETOPO_METHOD_NOTSUP));
-			}
-
-			for (i = 0; i < nelems; i++)
-				if ((ep = ipmi_entity_lookup_sdr(ihp, names[i]))
-				    != NULL)
-					break;
-
-			for (i = 0; i < nelems; i++)
-				topo_mod_strfree(mod, names[i]);
-			topo_mod_free(mod, names, (nelems * sizeof (char *)));
-
-			if (ep == NULL) {
-				topo_mod_dprintf(mod,
-				    "Failed to get present state of %s=%d\n",
-				    topo_node_name(tn), topo_node_instance(tn));
-				topo_mod_ipmi_rele(mod);
-				return (-1);
-			}
-			topo_node_setspecific(tn, ep);
-		}
-	}
+	err = ipmi_find_entity(mod, tn, &ihp, &ep, &name, &sdrp);
+	if (err != 0)
+		return (err);
 
 	if (ep != NULL) {
 		if (ipmi_entity_present(ihp, ep, &present) != 0) {
 			topo_mod_dprintf(mod,
 			    "ipmi_entity_present() failed: %s",
 			    ipmi_errmsg(ihp));
+			topo_mod_strfree(mod, name);
 			topo_mod_ipmi_rele(mod);
 			return (-1);
 		}
@@ -167,8 +193,21 @@
 		topo_mod_dprintf(mod,
 		    "ipmi_entity_present(%d, %d) = %d\n", ep->ie_type,
 		    ep->ie_instance, present);
+	} else if (sdrp != NULL) {
+		if (ipmi_entity_present_sdr(ihp, sdrp, &present) != 0) {
+			topo_mod_dprintf(mod,
+			    "Failed to get present state of %s (%s)\n",
+			    name, ipmi_errmsg(ihp));
+			topo_mod_strfree(mod, name);
+			topo_mod_ipmi_rele(mod);
+			return (-1);
+		}
+
+		topo_mod_dprintf(mod, "ipmi_entity_present_sdr(%s) = %d\n",
+		    name, present);
 	}
 
+	topo_mod_strfree(mod, name);
 	topo_mod_ipmi_rele(mod);
 
 	if (topo_mod_nvalloc(mod, &nvl, NV_UNIQUE_NAME) != 0)
@@ -185,6 +224,88 @@
 }
 
 /*
+ * Check whether an IPMI entity is a sensor that is unavailable
+ */
+static int
+ipmi_check_sensor(ipmi_handle_t *ihp, ipmi_entity_t *ep, const char *name,
+    ipmi_sdr_t *sdrp, void *data)
+{
+	ipmi_sdr_full_sensor_t *fsp;
+	ipmi_sdr_compact_sensor_t *csp;
+	uint8_t sensor_number;
+	ipmi_sensor_reading_t *reading;
+
+	switch (sdrp->is_type) {
+	case IPMI_SDR_TYPE_FULL_SENSOR:
+		fsp = (ipmi_sdr_full_sensor_t *)sdrp->is_record;
+		sensor_number = fsp->is_fs_number;
+		break;
+
+	case IPMI_SDR_TYPE_COMPACT_SENSOR:
+		csp = (ipmi_sdr_compact_sensor_t *)sdrp->is_record;
+		sensor_number = csp->is_cs_number;
+		break;
+
+	default:
+		return (0);
+	}
+
+	reading = ipmi_get_sensor_reading(ihp, sensor_number);
+	if (reading != NULL && reading->isr_state_unavailable)
+		return (1);
+
+	return (0);
+}
+
+/*
+ * Determine if the entity is unusable
+ */
+/*ARGSUSED*/
+static int
+ipmi_unusable(topo_mod_t *mod, tnode_t *tn, topo_version_t version,
+    nvlist_t *in, nvlist_t **out)
+{
+	ipmi_handle_t *ihp;
+	ipmi_entity_t *ep;
+	char *name;
+	ipmi_sdr_t *sdrp;
+	int err;
+	boolean_t unusable = B_FALSE;
+	nvlist_t *nvl;
+
+	err = ipmi_find_entity(mod, tn, &ihp, &ep, &name, &sdrp);
+	if (err != 0)
+		return (err);
+
+	/*
+	 * Check whether the IPMI presented us with an entity for a
+	 * sensor that is unavailable.
+	 */
+	if (ep != NULL) {
+		unusable = (ipmi_entity_iter_sdr(ihp, ep, ipmi_check_sensor,
+		    NULL) != 0);
+	} else if (sdrp != NULL) {
+		unusable = (ipmi_check_sensor(ihp, NULL, NULL, sdrp,
+		    NULL) != 0);
+	}
+
+	topo_mod_strfree(mod, name);
+	topo_mod_ipmi_rele(mod);
+
+	if (topo_mod_nvalloc(mod, &nvl, NV_UNIQUE_NAME) != 0)
+		return (topo_mod_seterrno(mod, EMOD_FMRI_NVL));
+
+	if (nvlist_add_uint32(nvl, TOPO_METH_UNUSABLE_RET, unusable) != 0) {
+		nvlist_free(nvl);
+		return (topo_mod_seterrno(mod, EMOD_FMRI_NVL));
+	}
+
+	*out = nvl;
+
+	return (0);
+}
+
+/*
  * This determines if the entity has a FRU locator record set, in which case we
  * treat this as a FRU, even if it's part of an association.
  */

--- a/usr/src/lib/libipmp/Makefile.com	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/lib/libipmp/Makefile.com	Thu Nov 14 23:30:04 2019 +0000
@@ -21,6 +21,7 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2019 Joyent, Inc.
 #
 
 LIBRARY =	libipmp.a
@@ -39,6 +40,10 @@
 CFLAGS +=	$(CCVERBOSE)
 CPPFLAGS +=	-D_REENTRANT -I$(SRCDIR)
 
+# ipmp_snap_take() generates false double free and dereferencing freed memory
+# errors
+pics/ipmp_query.o := SMOFF = check_free
+
 .KEEP_STATE:
 
 all: $(LIBS)

--- a/usr/src/lib/pkcs11/pkcs11_softtoken/common/softAESCrypt.c	Fri Nov 08 17:08:44 2019 +0100
+++ b/usr/src/lib/pkcs11/pkcs11_softtoken/common/softAESCrypt.c	Thu Nov 14 23:30:04 2019 +0000
@@ -22,7 +22,7 @@
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
- * Copyright (c) 2018, Joyent, Inc.
+ * Copyright 2019 Joyent, Inc.
  * Copyright 2017 Jason King.
  */
 
@@ -349,7 +349,7 @@
 		return (CKR_ARGUMENTS_BAD);
 	}
 
-	remainder = ulDataLen & (AES_BLOCK_LEN - 1);
+	remainder = ulDataLen % AES_BLOCK_LEN;
 
 	/*
 	 * CTR, CCM, CMAC, and GCM modes do not require the plaintext
@@ -372,23 +372,24 @@
 		}
 	}
 
-	switch (aes_ctx->ac_flags & (CMAC_MODE|CCM_MODE|GCM_MODE)) {
-	case CCM_MODE:
+	switch (mech) {
+	case CKM_AES_CCM:
 		length_needed = ulDataLen + aes_ctx->ac_mac_len;
 		break;
-	case GCM_MODE:
+	case CKM_AES_GCM:
 		length_needed = ulDataLen + aes_ctx->ac_tag_len;
 		break;
-	case CMAC_MODE:
+	case CKM_AES_CMAC:
+	case CKM_AES_CMAC_GENERAL:
 		length_needed = AES_BLOCK_LEN;
 		break;
+	case CKM_AES_CBC_PAD:
+		/* CKM_AES_CBC_PAD always adds 1..AES_BLOCK_LEN of padding */
+		length_needed = ulDataLen + AES_BLOCK_LEN - remainder;
+		break;
 	default:
 		length_needed = ulDataLen;
-
-		/* CKM_AES_CBC_PAD out pads to a multiple of AES_BLOCK_LEN */
-		if (mech == CKM_AES_CBC_PAD) {
-			length_needed += AES_BLOCK_LEN - remainder;
-		}
+		break;
 	}
 
 	if (pEncryptedData == NULL) {
@@ -424,58 +425,82 @@
 		out.cd_offset = *pulEncryptedDataLen;
 	}
 
-	/*
-	 * As CKM_AES_CTR is a stream cipher, ctr_mode_final is always
-	 * invoked in the _update() functions, so we do not need to call it
-	 * here.
-	 */
-	if (mech == CKM_AES_CBC_PAD) {
+	switch (mech) {
+	case CKM_AES_CBC_PAD: {
 		/*
 		 * aes_encrypt_contiguous_blocks() accumulates plaintext
-		 * in aes_ctx and then encrypts once it has accumulated
-		 * a multiple of AES_BLOCK_LEN bytes of plaintext (through one
-		 * or more calls).  Any leftover plaintext is left in aes_ctx
-		 * for subsequent calls.  If there is any remaining plaintext
-		 * at the end, we pad it out to to AES_BLOCK_LEN using the
-		 * amount of padding to add as the value of the pad bytes
-		 * (i.e. PKCS#7 padding) and call
-		 * aes_encrypt_contiguous_blocks() one last time.
+		 * in aes_ctx until it has at least one full block of
+		 * plaintext.  Any partial blocks of data remaining after
+		 * encrypting are left for subsequent calls to
+		 * aes_encrypt_contiguous_blocks().  If the input happened
+		 * to be an exact multiple of AES_BLOCK_LEN, we must still
+		 * append a block of padding (a full block in that case) so
+		 * that the correct amount of padding to remove is known
+		 * during decryption.
 		 *
-		 * Even when the input is already a multiple of AES_BLOCK_LEN,
-		 * we must add an additional full block so that we can determine
-		 * the amount of padding to remove during decryption (by
-		 * examining the last byte of the decrypted ciphertext).
+		 * soft_add_pkcs7_padding() is a bit overkill -- we just
+		 * create a block filled with the pad amount using memset(),
+		 * and encrypt 'amt' bytes of the block to pad out the input.
 		 */
+		char block[AES_BLOCK_LEN];
 		size_t amt = AES_BLOCK_LEN - remainder;
-		char block[AES_BLOCK_LEN];
 
-		ASSERT3U(remainder, ==, aes_ctx->ac_remainder_len);
-		ASSERT3U(amt + remainder, ==, AES_BLOCK_LEN);
+		VERIFY3U(remainder, ==, aes_ctx->ac_remainder_len);
 
-		/*
-		 * The existing soft_add_pkcs7_padding() interface is
-		 * overkill for what is effectively a memset().  A better
-		 * RFE would be to create a CBC_PAD mode.
-		 */
 		(void) memset(block, amt & 0xff, sizeof (block));
 		rc = aes_encrypt_contiguous_blocks(aes_ctx, block, amt, &out);
-	} else if (aes_ctx->ac_flags & CCM_MODE) {
+		rv = crypto2pkcs11_error_number(rc);
+		explicit_bzero(block, sizeof (block));
+		break;
+	}
+	case CKM_AES_CCM:
 		rc = ccm_encrypt_final((ccm_ctx_t *)aes_ctx, &out,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_xor_block);
-	} else if (aes_ctx->ac_flags & GCM_MODE) {
+		rv = crypto2pkcs11_error_number(rc);
+		break;
+	case CKM_AES_GCM:
 		rc = gcm_encrypt_final((gcm_ctx_t *)aes_ctx, &out,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_copy_block,
 		    aes_xor_block);
-	} else if (aes_ctx->ac_flags & CMAC_MODE) {
+		rv = crypto2pkcs11_error_number(rc);
+		break;
+	case CKM_AES_CMAC:
+	case CKM_AES_CMAC_GENERAL:
 		rc = cmac_mode_final((cbc_ctx_t *)aes_ctx, &out,
 		    aes_encrypt_block, aes_xor_block);
+		rv = crypto2pkcs11_error_number(rc);
 		aes_ctx->ac_remainder_len = 0;
+		break;
+	case CKM_AES_CTR:
+		/*
+		 * As CKM_AES_CTR is a stream cipher, ctr_mode_final is always
+		 * invoked in the xx_update() functions, so we do not need to
+		 * call it again here.
+		 */
+		break;
+	case CKM_AES_ECB:
+	case CKM_AES_CBC:
+		/*
+		 * These mechanisms do not have nor require a xx_final function.
+		 */
+		break;
+	default:
+		rv = CKR_MECHANISM_INVALID;
+		break;
 	}
 
 cleanup:
-	if (rc != CRYPTO_SUCCESS && rv == CKR_OK) {
+	switch (rv) {
+	case CKR_OK:
+		*pulEncryptedDataLen = out.cd_offset;
+		break;
+	case CKR_BUFFER_TOO_SMALL:
+		/* *pulEncryptedDataLen was set earlier */
+		break;
+	default:
+		/* something else failed */
 		*pulEncryptedDataLen = 0;
-		rv = crypto2pkcs11_error_number(rc);
+		break;
 	}
 
 	(void) pthread_mutex_lock(&session_p->session_mutex);
@@ -483,8 +508,124 @@
 	session_p->encrypt.context = NULL;
 	(void) pthread_mutex_unlock(&session_p->session_mutex);
 
-	if (rv == CKR_OK) {
-		*pulEncryptedDataLen = out.cd_offset;
+	return (rv);
+}
+
+static CK_RV
+soft_aes_cbc_pad_decrypt(aes_ctx_t *aes_ctx, CK_BYTE_PTR pEncryptedData,
+    CK_ULONG ulEncryptedDataLen, crypto_data_t *out_orig)
+{
+	aes_ctx_t *ctx = aes_ctx;
+	uint8_t *buf = NULL;
+	uint8_t *outbuf = (uint8_t *)out_orig->cd_raw.iov_base;
+	crypto_data_t out = *out_orig;
+	size_t i;
+	int rc;
+	CK_RV rv = CKR_OK;
+	uint8_t pad_len;
+	boolean_t speculate = B_FALSE;
+
+	/*
+	 * Just a query for the output size.  When the output buffer is
+	 * NULL, we are allowed to return a size slightly larger than
+	 * necessary.  We know the output will never be larger than the
+	 * input ciphertext, so we use that as an estimate.
+	 */
+	if (out_orig->cd_raw.iov_base == NULL) {
+		out_orig->cd_length = ulEncryptedDataLen;
+		return (CKR_OK);
+	}
+
+	/*
+	 * The output plaintext size will be 1..AES_BLOCK_LEN bytes
+	 * smaller than the input ciphertext.  However we cannot know
+	 * exactly how much smaller until we decrypt the entire
+	 * input ciphertext.  If we are unsure we have enough output buffer
+	 * space, we have to allocate our own memory to hold the output,
+	 * then see if we have enough room to hold the result.
+	 *
+	 * Unfortunately, having an output buffer that's too small does
+	 * not terminate the operation, nor are we allowed to return
+	 * partial results.  Therefore we must also duplicate the initial
+	 * aes_ctx so that this can potentially be run again.
+	 */
+	if (out_orig->cd_length < ulEncryptedDataLen) {
+		void *ks = malloc(aes_ctx->ac_keysched_len);
+
+		ctx = malloc(sizeof (*aes_ctx));
+		buf = malloc(ulEncryptedDataLen);
+		if (ks == NULL || ctx == NULL || buf == NULL) {
+			free(ks);
+			free(ctx);
+			free(buf);
+			return (CKR_HOST_MEMORY);
+		}
+
+		bcopy(aes_ctx, ctx, sizeof (*ctx));
+		bcopy(aes_ctx->ac_keysched, ks, aes_ctx->ac_keysched_len);
+		ctx->ac_keysched = ks;
+
+		out.cd_length = ulEncryptedDataLen;
+		out.cd_raw.iov_base = (char *)buf;
+		out.cd_raw.iov_len = ulEncryptedDataLen;
+		outbuf = buf;
+
+		speculate = B_TRUE;
+	}
+
+	rc = aes_decrypt_contiguous_blocks(ctx, (char *)pEncryptedData,
+	    ulEncryptedDataLen, &out);
+	if (rc != CRYPTO_SUCCESS) {
+		out_orig->cd_offset = 0;
+		rv = CKR_FUNCTION_FAILED;
+		goto done;
+	}
+
+	/*
+	 * RFC5652 6.3 The amount of padding must be
+	 * block_sz - (len mod block_size).  This means
+	 * the amount of padding must always be in the
+	 * range [1..block_size].
+	 */
+	pad_len = outbuf[ulEncryptedDataLen - 1];
+	if (pad_len == 0 || pad_len > AES_BLOCK_LEN) {
+		rv = CKR_ENCRYPTED_DATA_INVALID;
+		goto done;
+	}
+	out.cd_offset -= pad_len;
+
+	/*
+	 * Verify pad values, trying to do so in as close to constant
+	 * time as possible.
+	 */
+	for (i = ulEncryptedDataLen - pad_len; i < ulEncryptedDataLen; i++) {
+		if (outbuf[i] != pad_len) {
+			rv = CKR_ENCRYPTED_DATA_INVALID;
+		}
+	}
+	if (rv != CKR_OK) {
+		goto done;
+	}
+
+	if (speculate) {
+		if (out.cd_offset <= out_orig->cd_length) {
+			bcopy(out.cd_raw.iov_base, out_orig->cd_raw.iov_base,
+			    out.cd_offset);
+		} else {
+			rv = CKR_BUFFER_TOO_SMALL;
+		}
+	}
+
+	/*
+	 * No matter what, we report the exact size required.
+	 */
+	out_orig->cd_offset = out.cd_offset;
+
+done:
+	freezero(buf, ulEncryptedDataLen);
+	if (ctx != aes_ctx) {
+		VERIFY(speculate);
+		soft_aes_free_ctx(ctx);
 	}
 
 	return (rv);
@@ -518,7 +659,7 @@
 		return (CKR_ARGUMENTS_BAD);
 	}
 
-	remainder = ulEncryptedDataLen & (AES_BLOCK_LEN - 1);
+	remainder = ulEncryptedDataLen % AES_BLOCK_LEN;
 
 	/*
 	 * CTR, CCM, CMAC, and GCM modes do not require the ciphertext
@@ -540,6 +681,16 @@
 		}
 	}
 
+	if (mech == CKM_AES_CBC_PAD) {
+		rv = soft_aes_cbc_pad_decrypt(aes_ctx, pEncryptedData,
+		    ulEncryptedDataLen, &out);
+		if (pData == NULL || rv == CKR_BUFFER_TOO_SMALL) {
+			*pulDataLen = out.cd_offset;
+			return (rv);
+		}
+		goto cleanup;
+	}
+
 	switch (aes_ctx->ac_flags & (CCM_MODE|GCM_MODE)) {
 	case CCM_MODE:
 		length_needed = aes_ctx->ac_processed_data_len;
@@ -614,9 +765,7 @@
 	 * invoked in the _update() functions, so we do not need to call it
 	 * here.
 	 */
-	if (mech == CKM_AES_CBC_PAD) {
-		rv = soft_remove_pkcs7_padding(pData, *pulDataLen, pulDataLen);
-	} else if (aes_ctx->ac_flags & CCM_MODE) {
+	if (aes_ctx->ac_flags & CCM_MODE) {
 		ASSERT3U(aes_ctx->ac_processed_data_len, ==,
 		    aes_ctx->ac_data_len);
 		ASSERT3U(aes_ctx->ac_processed_mac_len, ==,
@@ -625,19 +774,18 @@
 		rc = ccm_decrypt_final((ccm_ctx_t *)aes_ctx, &out,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_copy_block,
 		    aes_xor_block);
+		rv = crypto2pkcs11_error_number(rc);
 	} else if (aes_ctx->ac_flags & GCM_MODE) {
 		rc = gcm_decrypt_final((gcm_ctx_t *)aes_ctx, &out,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_xor_block);
+		rv = crypto2pkcs11_error_number(rc);
 	}
 
 cleanup:
-	if (rc != CRYPTO_SUCCESS && rv == CKR_OK) {
-		rv = crypto2pkcs11_error_number(rc);
-		*pulDataLen = 0;
-	}
-
 	if (rv == CKR_OK) {
 		*pulDataLen = out.cd_offset;
+	} else {
+		*pulDataLen = 0;
 	}
 
 	(void) pthread_mutex_lock(&session_p->session_mutex);
@@ -667,24 +815,7 @@
 	int rc;
 
 	/* Check size of the output buffer */
-	if (mech == CKM_AES_CBC_PAD && (out_len <= AES_BLOCK_LEN)) {
-		/*
-		 * Since there is currently no CBC_PAD mode, we must stash any
-		 * remainder ourselves.  For all other modes,
-		 * aes_encrypt_contiguous_blocks() will call the mode specific
-		 * encrypt function and will stash any reminder if required.
-		 */
-		if (pData != NULL) {
-			uint8_t *dest = (uint8_t *)aes_ctx->ac_remainder +
-			    aes_ctx->ac_remainder_len;
-
-			bcopy(pData, dest, ulDataLen);
-			aes_ctx->ac_remainder_len += ulDataLen;
-		}
-
-		*pulEncryptedDataLen = 0;
-		return (CKR_OK);
-	} else if (aes_ctx->ac_flags & CMAC_MODE) {
+	if (aes_ctx->ac_flags & CMAC_MODE) {
 		/*
 		 * The underlying CMAC implementation handles the storing of
 		 * extra bytes and does not output any data until *_final,
@@ -725,8 +856,7 @@
 	*pulEncryptedDataLen = out.cd_offset;
 
 	if (rc != CRYPTO_SUCCESS) {
-		rv = CKR_FUNCTION_FAILED;
-		goto done;
+		return (CKR_FUNCTION_FAILED);
 	}
 
 	/*
@@ -738,11 +868,7 @@
 		rc = ctr_mode_final((ctr_ctx_t *)aes_ctx, &out,
 		    aes_encrypt_block);
 	}
-
-done:
-	if (rc != CRYPTO_SUCCESS && rv == CKR_OK) {
-		rv = crypto2pkcs11_error_number(rc);
-	}
+	rv = crypto2pkcs11_error_number(rc);
 
 	return (rv);
 }
@@ -752,6 +878,7 @@
     CK_ULONG ulEncryptedDataLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
 {
 	aes_ctx_t *aes_ctx = session_p->decrypt.context;
+	uint8_t *buffer_block = NULL;
 	crypto_data_t out = {
 		.cd_format = CRYPTO_DATA_RAW,
 		.cd_offset = 0,
@@ -761,35 +888,217 @@
 	};
 	CK_MECHANISM_TYPE mech = session_p->decrypt.mech.mechanism;
 	CK_RV rv = CKR_OK;
-	size_t out_len = 0;
+	size_t in_len = ulEncryptedDataLen;
+	size_t out_len;
 	int rc = CRYPTO_SUCCESS;
 
-	if ((aes_ctx->ac_flags & (CCM_MODE|GCM_MODE)) == 0) {
-		out_len = aes_ctx->ac_remainder_len + ulEncryptedDataLen;
+	switch (mech) {
+	case CKM_AES_CCM:
+	case CKM_AES_GCM:
+		out_len = 0;
+		break;
+	case CKM_AES_CBC_PAD:
+		/*
+		 * For CKM_AES_CBC_PAD, we use the existing code for CBC
+		 * mode in libsoftcrypto (which itself uses the code in
+		 * usr/src/common/crypto/modes for CBC mode).  For
+		 * non-padding AES CBC mode, aes_decrypt_contiguous_blocks()
+		 * will accumulate ciphertext in aes_ctx->ac_remainder until
+		 * there is at least AES_BLOCK_LEN bytes of ciphertext available
+		 * to decrypt.  At that point, as many blocks of AES_BLOCK_LEN
+		 * sized ciphertext blocks are decrypted.  Any remainder is
+		 * copied into aes_ctx->ac_remainder for decryption in
+		 * subsequent calls to aes_decrypt_contiguous_blocks().
+		 *
+		 * When PKCS#7 padding is used, the buffering
+		 * aes_decrypt_contigous_blocks() performs is insufficient.
+		 * PKCS#7 padding always adds [1..AES_BLOCK_LEN] bytes of
+		 * padding to plaintext, so the resulting ciphertext is always
+		 * larger than the input plaintext.  However we cannot know
+		 * which block is the final block (and needs its padding
+		 * stripped) until C_DecryptFinal() is called.  Additionally,
+		 * it is permissible for a caller to use buffers sized to the
+		 * output plaintext -- i.e. smaller than the input ciphertext.
+		 * This leads to a more complicated buffering/accumulation
+		 * strategy than what aes_decrypt_contiguous_blocks() provides
+		 * us.
+		 *
+		 * Our buffering strategy works as follows:
+		 *  For each call to C_DecryptUpdate, we calculate the
+		 *  total amount of ciphertext available (buffered plus what's
+		 *  passed in) as the initial output size (out_len). Based
+		 *  on the value of out_len, there are three possibilties:
+		 *
+		 *  1. We have less than AES_BLOCK_LEN + 1 bytes of
+		 *  ciphertext available. Accumulate the ciphertext in
+		 *  aes_ctx->ac_remainder. Note that while we could let
+		 *  aes_decrypt_contiguous_blocks() buffer the input for us
+		 *  when we have less than AES_BLOCK_LEN bytes, we would still
+		 *  need to buffer when we have exactly AES_BLOCK_LEN
+		 *  bytes available, so we just handle both situations with
+		 *  one if clause.
+		 *
+		 *  2. We have at least AES_BLOCK_LEN + 1 bytes of
+		 *  ciphertext, and the total amount available is also an
+		 *  exact multiple of AES_BLOCK_LEN. We cannot know if the
+		 *  last block of input is the final block (yet), but we
+		 *  are an exact multiple of AES_BLOCK_LEN, and we have
+		 *  at least AES_BLOCK_LEN + 1 bytes available, therefore
+		 *  there must be at least 2 * AES_BLOCK_LEN bytes of input
+		 *  ciphertext available. It also means there's at least one
+		 *  full block of input ciphertext that can be decrypted. We
+		 *  reduce the size of the input (in_len) given to
+		 *  aes_decrypt_contiguous_bytes() by AES_BLOCK_LEN to prevent
+		 *  it from decrypting the last full block of data.
+		 *  aes_decrypt_contiguous_blocks() will when decrypt any
+		 *  buffered data in aex_ctx->ac_remainder, and then any
+		 *  input data passed. Since we have an exact multiple of
+		 *  AES_BLOCK_LEN, aes_ctx->ac_remainder will be empty
+		 *  (aes_ctx->ac_remainder_len == 0), once
+		 *  aes_decrypt_contiguout_block() completes, and we can
+		 *  copy the last block of data into aes_ctx->ac_remainder.
+		 *
+		 *  3. We have at least AES_BLOCK_LEN + 1 bytes of
+		 *  ciphertext, but the total amount available is not an
+		 *  exact multiple of AES_BLOCK_LEN. We decrypt all of
+		 *  full blocks of data we have. The remainder will be
+		 *  less than AES_BLOCK_LEN bytes. We let
+		 *  aes_decrypt_contiguous_blocks() buffer the remainder
+		 *  for us since it would normally do this anyway. Since there
+		 *  is a remainder, the full blocks that are present cannot
+		 *  be the last block, so we can safey decrypt all of them.
+		 *
+		 * Some things to note:
+		 *  - The above semantics will cause aes_ctx->ac_remainder to
+		 *  never accumulate more than AES_BLOCK_LEN bytes of
+		 *  ciphertext. Once we reach at least AES_BLOCK_LEN + 1 bytes,
+		 *  we will decrypt the contents of aes_ctx->ac_remainder by one
+		 *  of the last two scenarios described above.
+		 *
+		 *  - We must always end up with AES_BLOCK_LEN bytes of data
+		 *  in aes_ctx->ac_remainder when C_DecryptFinal() is called.
+		 *  The first and third scenarios above may leave
+		 *  aes_ctx->ac_remainder with less than AES_BLOCK_LEN bytes,
+		 *  however the total size of the input ciphertext that's
+		 *  been decrypted must end up a multiple of AES_BLOCK_LEN.
+		 *  Therefore, we can always assume when there is a
+		 *  remainder that more data is coming.  If we do end up
+		 *  with a remainder that's not AES_BLOCK_LEN bytes long
+		 *  when C_DecryptFinal() is called, the input is assumed
+		 *  invalid and we return CKR_DATA_LEN_RANGE (see
+		 *  soft_aes_decrypt_final()).
+		 */
 
-		if (mech == CKM_AES_CBC_PAD && out_len <= AES_BLOCK_LEN) {
+		VERIFY3U(aes_ctx->ac_remainder_len, <=, AES_BLOCK_LEN);
+		if (in_len >= SIZE_MAX - AES_BLOCK_LEN)
+			return (CKR_ENCRYPTED_DATA_LEN_RANGE);
+
+		out_len = aes_ctx->ac_remainder_len + in_len;
+
+		if (out_len <= AES_BLOCK_LEN) {
+			/*
+			 * The first scenario detailed above, accumulate
+			 * ciphertext in ac_remainder_len and return.
+			 */
 			uint8_t *dest = (uint8_t *)aes_ctx->ac_remainder +
 			    aes_ctx->ac_remainder_len;
 
-			bcopy(pEncryptedData, dest, ulEncryptedDataLen);
-			aes_ctx->ac_remainder_len += ulEncryptedDataLen;
+			bcopy(pEncryptedData, dest, in_len);
+			aes_ctx->ac_remainder_len += in_len;
+			*pulDataLen = 0;
+
+			/*
+			 * Since we aren't writing an output, and are returning
+			 * here, we don't need to adjust out_len -- we never
+			 * reach the output buffer size checks after the
+			 * switch statement.
+			 */
 			return (CKR_OK);
+		} else if (out_len % AES_BLOCK_LEN == 0) {
+			/*
+			 * The second scenario decribed above. The total amount
+			 * available is a multiple of AES_BLOCK_LEN, and
+			 * we have more than one block.  We reduce the
+			 * input size (in_len) by AES_BLOCK_LEN. We also
+			 * reduce the output size (out_len) by AES_BLOCK_LEN
+			 * for the output buffer size checks that follow
+			 * the switch statement. In certain situations,
+			 * PKCS#11 requires this to be an exact value, so
+			 * the size check cannot occur for CKM_AES_CBC_PAD
+			 * until after we've determine which scenario we
+			 * have.
+			 *
+			 * Because we never accumulate more than AES_BLOCK_LEN
+			 * bytes in aes_ctx->ac_remainder, when we are in
+			 * this scenario, the following VERIFYs should always
+			 * be true (and serve as a final safeguard against
+			 * underflow).
+			 */
+			VERIFY3U(in_len, >=, AES_BLOCK_LEN);
+
+			buffer_block = pEncryptedData + in_len - AES_BLOCK_LEN;
+
+			in_len -= AES_BLOCK_LEN;
+
+			/*
+			 * This else clause explicity checks
+			 * out_len > AES_BLOCK_LEN, so this is also safe.
+			 */
+			out_len -= AES_BLOCK_LEN;
+		} else {
+			/*
+			 * The third scenario above.  We have at least
+			 * AES_BLOCK_LEN + 1 bytes, but the total amount of
+			 * input ciphertext available is not an exact
+			 * multiple of AES_BLOCK_LEN.  Let
+			 * aes_decrypt_contiguous_blocks() handle the
+			 * buffering of the remainder.  Update the
+			 * output size to reflect the actual amount of output
+			 * we want to emit for the checks after the switch
+			 * statement.
+			 */
+			out_len &= ~(AES_BLOCK_LEN - 1);
 		}
+		break;
+	default:
+		out_len = aes_ctx->ac_remainder_len + in_len;
 		out_len &= ~(AES_BLOCK_LEN - 1);
+		break;
 	}
 
+	/*
+	 * C_DecryptUpdate() verifies that pulDataLen is not NULL prior
+	 * to calling soft_decrypt_common() (which calls us).
+	 */
+
 	if (pData == NULL) {
+		/*
+		 * If the output buffer (pData) is NULL, that means the
+		 * caller is inquiring about the size buffer needed to
+		 * complete the C_DecryptUpdate() request.  While we are
+		 * permitted to set *pulDataLen to an estimated value that can
+		 * be 'slightly' larger than the actual value required,
+		 * since we know the exact size we need, we stick with the
+		 * exact size.
+		 */
 		*pulDataLen = out_len;
 		return (CKR_OK);
 	}
 
 	if (*pulDataLen < out_len) {
+		/*
+		 * Not an inquiry, but the output buffer isn't large enough.
+		 * PKCS#11 requires that this scenario not fail fatally (as
+		 * well as return a different error value). This situation
+		 * also requires us to set *pulDataLen to the _exact_ size
+		 * required.
+		 */
 		*pulDataLen = out_len;
 		return (CKR_BUFFER_TOO_SMALL);
 	}
 
 	rc = aes_decrypt_contiguous_blocks(aes_ctx, (char *)pEncryptedData,
-	    ulEncryptedDataLen, &out);
+	    in_len, &out);
 
 	if (rc != CRYPTO_SUCCESS) {
 		rv = CKR_FUNCTION_FAILED;
@@ -798,16 +1107,34 @@
 
 	*pulDataLen = out.cd_offset;
 
-	if ((aes_ctx->ac_flags & CTR_MODE) && (aes_ctx->ac_remainder_len > 0)) {
+	switch (mech) {
+	case CKM_AES_CTR:
+		if (aes_ctx->ac_remainder_len == 0) {
+			break;
+		}
 		rc = ctr_mode_final((ctr_ctx_t *)aes_ctx, &out,
 		    aes_encrypt_block);
+		rv = crypto2pkcs11_error_number(rc);
+		break;
+	case CKM_AES_CBC_PAD:
+		if (buffer_block == NULL) {
+			break;
+		}
+
+		VERIFY0(aes_ctx->ac_remainder_len);
+
+		/*
+		 * We had multiple blocks of data to decrypt with nothing
+		 * left over and deferred decrypting the last block of data.
+		 * Copy it into aes_ctx->ac_remainder to decrypt on the
+		 * next update call (or final).
+		 */
+		bcopy(buffer_block, aes_ctx->ac_remainder, AES_BLOCK_LEN);
+		aes_ctx->ac_remainder_len = AES_BLOCK_LEN;
+		break;
 	}
 
 done:
-	if (rc != CRYPTO_SUCCESS && rv == CKR_OK) {
-		rv = crypto2pkcs11_error_number(rc);
-	}
-
 	return (rv);
 }
 
@@ -823,60 +1150,104 @@
 		.cd_raw.iov_base = (char *)pLastEncryptedPart,
 		.cd_raw.iov_len = *pulLastEncryptedPartLen
 	};
-	int rc = CRYPTO_SUCCESS;
+	CK_MECHANISM_TYPE mech = session_p->encrypt.mech.mechanism;
 	CK_RV rv = CKR_OK;
+	size_t out_len;
+	int rc = CRYPTO_SUCCESS;
 
-	if (session_p->encrypt.mech.mechanism == CKM_AES_CBC_PAD) {
+	switch (mech) {
+	case CKM_AES_CBC_PAD:
+		/*
+		 * We always add 1..AES_BLOCK_LEN of padding to the input
+		 * plaintext to round up to a multiple of AES_BLOCK_LEN.
+		 * During encryption, we never output a partially encrypted
+		 * block (that is the amount encrypted by each call of
+		 * C_EncryptUpdate() is always either 0 or n * AES_BLOCK_LEN).
+		 * As a result, at the end of the encryption operation, we
+		 * output AES_BLOCK_LEN bytes of data -- this could be a full
+		 * block of padding, or a combination of data + padding.
+		 */
+		out_len = AES_BLOCK_LEN;
+		break;
+	case CKM_AES_CTR:
+		out_len = aes_ctx->ac_remainder_len;
+		break;
+	case CKM_AES_CCM:
+		out_len = aes_ctx->ac_remainder_len +
+		    aes_ctx->acu.acu_ccm.ccm_mac_len;
+		break;
+	case CKM_AES_GCM:
+		out_len = aes_ctx->ac_remainder_len +
+		    aes_ctx->acu.acu_gcm.gcm_tag_len;
+		break;
+	case CKM_AES_CMAC:
+	case CKM_AES_CMAC_GENERAL:
+		out_len = AES_BLOCK_LEN;
+		break;
+	default:
+		/*
+		 * Everything other AES mechansism requires full blocks of
+		 * input.  If the input was not an exact multiple of
+		 * AES_BLOCK_LEN, it is a fatal error.
+		 */
+		if (aes_ctx->ac_remainder_len > 0) {
+			rv = CKR_DATA_LEN_RANGE;
+			goto done;
+		}
+		out_len = 0;
+	}
+
+	if (*pulLastEncryptedPartLen < out_len || pLastEncryptedPart == NULL) {
+		*pulLastEncryptedPartLen = out_len;
+		return ((pLastEncryptedPart == NULL) ?
+		    CKR_OK : CKR_BUFFER_TOO_SMALL);
+	}
+
+	switch (mech) {
+	case CKM_AES_CBC_PAD: {
 		char block[AES_BLOCK_LEN] = { 0 };
 		size_t padlen = AES_BLOCK_LEN - aes_ctx->ac_remainder_len;
 
-		(void) memset(block, padlen & 0xff, sizeof (block));
-		if (padlen > 0) {
-			rc = aes_encrypt_contiguous_blocks(aes_ctx, block,
-			    padlen, &data);
-		}
-	} else if (aes_ctx->ac_flags & CTR_MODE) {
-		if (pLastEncryptedPart == NULL) {
-			*pulLastEncryptedPartLen = aes_ctx->ac_remainder_len;
-			return (CKR_OK);
+		if (padlen == 0) {
+			padlen = AES_BLOCK_LEN;
 		}
 
-		if (aes_ctx->ac_remainder_len > 0) {
-			rc = ctr_mode_final((ctr_ctx_t *)aes_ctx, &data,
-			    aes_encrypt_block);
-			if (rc == CRYPTO_BUFFER_TOO_SMALL) {
-				rv = CKR_BUFFER_TOO_SMALL;
-			}
+		(void) memset(block, padlen & 0xff, sizeof (block));
+		rc = aes_encrypt_contiguous_blocks(aes_ctx, block,
+		    padlen, &data);
+		explicit_bzero(block, sizeof (block));
+		break;
+	}
+	case CKM_AES_CTR:
+		if (aes_ctx->ac_remainder_len == 0) {
+			break;
 		}
-	} else if (aes_ctx->ac_flags & CCM_MODE) {
+
+		rc = ctr_mode_final((ctr_ctx_t *)aes_ctx, &data,
+		    aes_encrypt_block);
+		break;
+	case CKM_AES_CCM:
 		rc = ccm_encrypt_final((ccm_ctx_t *)aes_ctx, &data,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_xor_block);
-	} else if (aes_ctx->ac_flags & GCM_MODE) {
+		break;
+	case CKM_AES_GCM:
 		rc = gcm_encrypt_final((gcm_ctx_t *)aes_ctx, &data,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_copy_block,
 		    aes_xor_block);
-	} else if (aes_ctx->ac_flags & CMAC_MODE) {
-		if (pLastEncryptedPart == NULL) {
-			*pulLastEncryptedPartLen = AES_BLOCK_LEN;
-			return (CKR_OK);
-		}
-
+		break;
+	case CKM_AES_CMAC:
+	case CKM_AES_CMAC_GENERAL:
 		rc = cmac_mode_final((cbc_ctx_t *)aes_ctx, &data,
 		    aes_encrypt_block, aes_xor_block);
-	} else {
-		/*
-		 * There must be no unprocessed plaintext.
-		 * This happens if the length of the last data is not a
-		 * multiple of the AES block length.
-		 */
-		*pulLastEncryptedPartLen = 0;
-		if (aes_ctx->ac_remainder_len > 0) {
-			rv = CKR_DATA_LEN_RANGE;
-		}
+		break;
+	default:
+		break;
 	}
+	rv = crypto2pkcs11_error_number(rc);
 
-	if (rc != CRYPTO_SUCCESS && rv == CKR_OK) {
-		rv = crypto2pkcs11_error_number(rc);
+done:
+	if (rv == CKR_OK) {
+		*pulLastEncryptedPartLen = data.cd_offset;
 	}
 
 	soft_aes_free_ctx(aes_ctx);
@@ -892,6 +1263,7 @@
 	CK_MECHANISM_TYPE mech = session_p->decrypt.mech.mechanism;
 	CK_RV rv = CKR_OK;
 	int rc = CRYPTO_SUCCESS;
+	size_t out_len;
 	crypto_data_t out = {
 		.cd_format = CRYPTO_DATA_RAW,
 		.cd_offset = 0,
@@ -900,93 +1272,154 @@
 		.cd_raw.iov_len = *pulLastPartLen
 	};
 
-	if (aes_ctx->ac_remainder_len > 0) {
-		switch (mech) {
-		case CKM_AES_CBC_PAD:
-			/*
-			 * Since we cannot know the amount of padding present
-			 * until after we decrypt the final block, and since
-			 * we don't know which block is the last block until
-			 * C_DecryptFinal() is called, we must always defer
-			 * decrypting the most recent block of ciphertext
-			 * until C_DecryptFinal() is called.  As a consequence,
-			 * we should always have a remainder, and it should
-			 * always be equal to AES_BLOCK_LEN.
-			 */
+	switch (mech) {
+	case CKM_AES_CBC_PAD:
+		/*
+		 * PKCS#11 requires that a caller can discover the size of
+		 * the output buffer required by calling
+		 * C_DecryptFinal(hSession, NULL, &len) which sets
+		 * *pulLastPartLen to the size required.  However, it also
+		 * allows if one calls C_DecryptFinal with a buffer (i.e.
+		 * pLastPart != NULL) that is too small, to return
+		 * CKR_BUFFER_TOO_SMALL with *pulLastPartLen set to the
+		 * _exact_ size required (when pLastPart is NULL, the
+		 * implementation is allowed to set a 'sightly' larger
+		 * value than is strictly necessary.  In either case, the
+		 * caller is allowed to retry the operation (the operation
+		 * is not terminated).
+		 *
+		 * With PKCS#7 padding, we cannot determine the exact size of
+		 * the output until we decrypt the final block.  As such, the
+		 * first time for a given decrypt operation we are called,
+		 * we decrypt the final block and stash it in the aes_ctx
+		 * remainder block.  On any subsequent calls in the
+		 * current decrypt operation, we then can use the decrypted
+		 * block as necessary to provide the correct semantics.
+		 *
+		 * The cleanup of aes_ctx when the operation terminates
+		 * will take care of clearing out aes_ctx->ac_remainder_len.
+		 */
+		if ((aes_ctx->ac_flags & P11_DECRYPTED) == 0) {
+			uint8_t block[AES_BLOCK_LEN] = { 0 };
+			crypto_data_t block_out = {
+				.cd_format = CRYPTO_DATA_RAW,
+				.cd_offset = 0,
+				.cd_length = sizeof (block),
+				.cd_raw.iov_base = (char *)block,
+				.cd_raw.iov_len = sizeof (block)
+			};
+			size_t amt, i;
+			uint8_t pad_len;
+
 			if (aes_ctx->ac_remainder_len != AES_BLOCK_LEN) {
-				return (CKR_ENCRYPTED_DATA_LEN_RANGE);
-			}
-
-			if (*pulLastPartLen < AES_BLOCK_LEN) {
-				*pulLastPartLen = AES_BLOCK_LEN;
-				return (CKR_BUFFER_TOO_SMALL);
+				return (CKR_DATA_LEN_RANGE);
 			}
 
 			rc = aes_decrypt_contiguous_blocks(aes_ctx,
-			    (char *)pLastPart, AES_BLOCK_LEN, &out);
+			    (char *)block, 0, &block_out);
+			if (rc != CRYPTO_SUCCESS) {
+				explicit_bzero(block, sizeof (block));
+				return (CKR_FUNCTION_FAILED);
+			}
+
+			pad_len = block[AES_BLOCK_LEN - 1];
 
-			if (rc != CRYPTO_SUCCESS) {
-				break;
+			/*
+			 * RFC5652 6.3 The amount of padding must be
+			 * block_sz - (len mod block_size).  This means
+			 * the amount of padding must always be in the
+			 * range [1..block_size].
+			 */
+			if (pad_len == 0 || pad_len > AES_BLOCK_LEN) {
+				rv = CKR_ENCRYPTED_DATA_INVALID;
+				explicit_bzero(block, sizeof (block));
+				goto done;
+			}
+			amt = AES_BLOCK_LEN - pad_len;
+
+			/*
+			 * Verify the padding is correct.  Try to do so
+			 * in as constant a time as possible.
+			 */
+			for (i = amt; i < AES_BLOCK_LEN; i++) {
+				if (block[i] != pad_len) {
+					rv = CKR_ENCRYPTED_DATA_INVALID;
+				}
+			}
+			if (rv != CKR_OK) {
+				explicit_bzero(block, sizeof (block));
+				goto done;
 			}
 
-			rv = soft_remove_pkcs7_padding(pLastPart, AES_BLOCK_LEN,
-			    pulLastPartLen);
-			break;
-		case CKM_AES_CTR:
-			rc = ctr_mode_final((ctr_ctx_t *)aes_ctx, &out,
-			    aes_encrypt_block);
-			break;
-		default:
-			/* There must be no unprocessed ciphertext */
-			return (CKR_ENCRYPTED_DATA_LEN_RANGE);
+			bcopy(block, aes_ctx->ac_remainder, amt);
+			explicit_bzero(block, sizeof (block));
+
+			aes_ctx->ac_flags |= P11_DECRYPTED;
+			aes_ctx->ac_remainder_len = amt;
 		}
-	} else {
+
+		out_len = aes_ctx->ac_remainder_len;
+		break;
+	case CKM_AES_CTR:
+		out_len = aes_ctx->ac_remainder_len;
+		break;
+	case CKM_AES_CCM:
+		out_len = aes_ctx->ac_data_len;
+		break;
+	case CKM_AES_GCM:
+		out_len = aes_ctx->acu.acu_gcm.gcm_processed_data_len -
+		    aes_ctx->acu.acu_gcm.gcm_tag_len;
+		break;
+	default:
 		/*
-		 * We should never have no remainder for AES_CBC_PAD -- see
-		 * above.
+		 * The remaining mechanims require an exact multiple of
+		 * AES_BLOCK_LEN of ciphertext.  Any other value is an error.
 		 */
-		ASSERT3U(mech, !=, CKM_AES_CBC_PAD);
+		if (aes_ctx->ac_remainder_len > 0) {
+			rv = CKR_DATA_LEN_RANGE;
+			goto done;
+		}
+		out_len = 0;
+		break;
 	}
 
-	if (aes_ctx->ac_flags & CCM_MODE) {
-		size_t pt_len = aes_ctx->ac_data_len;
+	if (*pulLastPartLen < out_len || pLastPart == NULL) {
+		*pulLastPartLen = out_len;
+		return ((pLastPart == NULL) ? CKR_OK : CKR_BUFFER_TOO_SMALL);
+	}
 
-		if (*pulLastPartLen < pt_len) {
-			*pulLastPartLen = pt_len;
-			return (CKR_BUFFER_TOO_SMALL);
+	switch (mech) {
+	case CKM_AES_CBC_PAD:
+		*pulLastPartLen = out_len;
+		if (out_len == 0) {
+			break;
 		}
-
-		ASSERT3U(aes_ctx->ac_processed_data_len, ==, pt_len);
+		bcopy(aes_ctx->ac_remainder, pLastPart, out_len);
+		out.cd_offset += out_len;
+		break;
+	case CKM_AES_CCM:
+		ASSERT3U(aes_ctx->ac_processed_data_len, ==, out_len);
 		ASSERT3U(aes_ctx->ac_processed_mac_len, ==,
 		    aes_ctx->ac_mac_len);
 
 		rc = ccm_decrypt_final((ccm_ctx_t *)aes_ctx, &out,
 		    AES_BLOCK_LEN, aes_encrypt_block, aes_copy_block,
 		    aes_xor_block);
-
-		if (rc != CRYPTO_SUCCESS) {
-			*pulLastPartLen = out.cd_offset;
-		}
-	} else if (aes_ctx->ac_flags & GCM_MODE) {
-		gcm_ctx_t *gcm_ctx = (gcm_ctx_t *)aes_ctx;
-		size_t pt_len = gcm_ctx->gcm_processed_data_len -
-		    gcm_ctx->gcm_tag_len;
-
-		if (*pulLastPartLen < pt_len) {
-			*pulLastPartLen = pt_len;
-			return (CKR_BUFFER_TOO_SMALL);
-		}
-
-		rc = gcm_decrypt_final(gcm_ctx, &out, AES_BLOCK_LEN,
-		    aes_encrypt_block, aes_xor_block);
-
-		if (rc != CRYPTO_SUCCESS) {
-			*pulLastPartLen = out.cd_offset;
-		}
+		break;
+	case CKM_AES_GCM:
+		rc = gcm_decrypt_final((gcm_ctx_t *)aes_ctx, &out,
+		    AES_BLOCK_LEN, aes_encrypt_block, aes_xor_block);
+		break;
+	default:
+		break;
 	}
 
-	if (rv == CKR_OK && rc != CRYPTO_SUCCESS) {
-		rv = crypto2pkcs11_error_number(rc);
+	VERIFY3U(out.cd_offset, ==, out_len);
+	rv = crypto2pkcs11_error_number(rc);
+
+done:
+	if (rv == CKR_OK) {
+		*pulLastPartLen = out.cd_offset;
 	}
 
 	soft_aes_free_ctx(aes_ctx);