- Copy stable/10@296371 to releng/10.3 in preparation for 10.3-RC1
builds.
- Update newvers.sh to reflect RC1.
- Update __FreeBSD_version to reflect 10.3.
- Update default pkg(8) configuration to use the quarterly branch.

Approved by: re (implicit)

MFC r280685: When searching for provider by name, prefer non-withered one.

MFC r256956:
Improve ZFS N-way mirror read performance by using load and locality
information.

MFC r260713:
Fix ZFS mirror code for handling multiple DVA's

Also make the addition of the d_rotation_rate binary compatible. This allows
storage drivers compiled for 10.0 to work by preserving the ABI for disks.

Approved by: re (gjb)
Sponsored by: Multiplay

MFC r266445:
Add a topology trace to the g_spoil_event.

MFC r264499:

Make g_access() KASSERT() more useful.

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Introduce a kern.geom.notaste sysctl that can be used to temporarily
disable GEOM tasting to avoid the "bouncing GEOM" problem where, when
you shut down the consumer of a provider which can be viewed in multiple
ways (typically a mirror whose members are labeled partitions), GEOM
will immediately taste that provider's alter ego and reattach the
consumer.

Approved by: re (glebius)

Make g_wither_washer() to not loop by itself, but only when there was some
more topology change done that may require its attention. Add few missing
g_do_wither() calls in respective places to signal it.

This fixes potential infinite loop here when some provider is withered, but
still opened or connected for some reason and so can not be destroyed. For
example, see r227009 and r227510.

Allow to pass providers with /dev/ prefix to g_provider_by_name().

MFC after: 3 days

Remove unneeded G_PF_CANDELETE flag.

This flag is only used by GEOM so it can be propagated to the character
device's SI_CANDELETE. Unfortunately, SI_CANDELETE seems to do nothing.

Implement media change notification for DA and CD removable media devices.
It includes three parts:
1) Modifications to CAM to detect media media changes and report them to
disk(9) layer. For modern SATA (and potentially UAS) devices it utilizes
Asynchronous Notification mechanism to receive events from hardware.
Active polling with TEST UNIT READY commands with 3 seconds period is used
for incapable hardware. After that both CD and DA drivers work the same way,
detecting two conditions: "NOT READY: Medium not present" after medium was
detected previously, and "UNIT ATTENTION: Not ready to ready change, medium
may have changed". First one reported to disk(9) as media removal, second
as media insert/change. To reliably receive second event new
AC_UNIT_ATTENTION async added to make UAs broadcasted to all periphs by
generic error handling code in cam_periph_error().
2) Modifications to GEOM core to handle media remove and change events.
Media removal handled by spoiling all consumers attached to the provider.
Media change event also schedules provider retaste after spoiling to probe
new media. New flag G_CF_ORPHAN was added to consumers to reflect that
consumer is in process of destruction. It allows retaste to create new
geom instance of the same class, while previous one is still dying.
3) Modifications to some GEOM classes: DEV -- to report media change
events to devd; VFS -- to handle spoiling same as orphan to prevent
accessing replaced media. PART class already handles spoiling alike to
orphan.

Reviewed by: silence on geom@ and scsi@
Tested by: avg
Sponsored by: iXsystems, Inc. / PC-BSD
MFC after: 2 months

Add missing free.

The resize GEOM event has no references, thus cannot be canceled.

Add a new GEOM method, resize(), which is called after provider size changes.
Add a new routine, g_resize_provider(), to use to notify GEOM about provider
change.

Reviewed by: mav
Sponsored by: FreeBSD Foundation

Fix a bug which causes a panic in daopen(). The panic is caused by
a da(4) instance going away while GEOM is still probing it.

In this case, the GEOM disk class instance has been created by
disk_create(), and the taste of the disk is queued in the GEOM
event queue.

While that event is queued, the da(4) instance goes away. When the
open call comes into the da(4) driver, it dereferences the freed
(but non-NULL) peripheral pointer provided by GEOM, which results
in a panic.

The solution is to add a callback to the GEOM disk code that is
called when all of its resources are cleaned up. This is
implemented inside GEOM by adding an optional callback that is
called when all consumers have detached from a provider, and the
provider is about to be deleted.

scsi_cd.c,
scsi_da.c: In the register routine for the cd(4) and da(4)
routines, acquire a reference to the CAM peripheral
instance just before we call disk_create().

Use the new GEOM disk d_gone() callback to register
a callback (dadiskgonecb()/cddiskgonecb()) that
decrements the peripheral reference count once GEOM
has finished cleaning up its resources.

In the cd(4) driver, clean up open and close
behavior slightly. GEOM makes sure we only get one
open() and one close call, so there is no need to
set an open flag and decrement the reference count
if we are not the first open.

In the cd(4) driver, use cam_periph_release_locked()
in a couple of error scenarios to avoid extra mutex
calls.

geom.h: Add a new, optional, providergone callback that
is called when a provider is about to be deleted.

geom_disk.h: Add a new d_gone() callback to the GEOM disk
interface.

Bump the DISK_VERSION to version 2. This probably
should have been done after a couple of previous
changes, especially the addition of the d_getattr()
callback.

geom_disk.c: Add a providergone callback for the disk class,
g_disk_providergone(), that calls the user's
d_gone() callback if it exists.

Bump the DISK_VERSION to 2.

geom_subr.c: In g_destroy_provider(), call the providergone
callback if it has been provided.

In g_new_geomf(), propagate the class's
providergone callback to the new geom instance.

blkfront.c: Callers of disk_create() are supposed to pass in
DISK_VERSION, not an explicit disk API version
number. Update the blkfront driver to do that.

disk.9: Update the disk(9) man page to include information
on the new d_gone() callback, as well as the
previously added d_getattr() callback, d_descr
field, and HBA PCI ID fields.

MFC after: 5 days

Plumb device physical path reporting from CAM devices, through GEOM and
DEVFS, and make it accessible via the diskinfo utility.

Extend GEOM's generic attribute query mechanism into generic disk consumers.
sys/geom/geom_disk.c:
sys/geom/geom_disk.h:
sys/cam/scsi/scsi_da.c:
sys/cam/ata/ata_da.c:
- Allow disk providers to implement a new method which can override
the default BIO_GETATTR response, d_getattr(struct bio *). This
function returns -1 if not handled, otherwise it returns 0 or an
errno to be passed to g_io_deliver().

sys/cam/scsi/scsi_da.c:
sys/cam/ata/ata_da.c:
- Don't copy the serial number to dp->d_ident anymore, as the CAM XPT
is now responsible for returning this information via
d_getattr()->(a)dagetattr()->xpt_getatr().

sys/geom/geom_dev.c:
- Implement a new ioctl, DIOCGPHYSPATH, which returns the GEOM
attribute "GEOM::physpath", if possible. If the attribute request
returns a zero-length string, ENOENT is returned.

usr.sbin/diskinfo/diskinfo.c:
- If the DIOCGPHYSPATH ioctl is successful, report physical path
data when diskinfo is executed with the '-v' option.

Submitted by: will
Reviewed by: gibbs
Sponsored by: Spectra Logic Corporation

Add generic attribute change notification support to GEOM.

sys/sys/geom/geom.h:
Add a new attrchanged method field to both g_class
and g_geom.

sys/sys/geom/geom.h:
sys/geom/geom_event.c:
- Provide the g_attr_changed() function that providers
can use to advertise attribute changes.
- Perform delivery of attribute change notifications
from a thread context via the standard GEOM event
mechanism.

sys/geom/geom_subr.c:
Inherit the attrchanged method from class to geom (class instance).

sys/geom/geom_disk.c:
Provide disk_attr_changed() to provide g_attr_changed() access
to consumers of the disk API.

sys/cam/scsi/scsi_pass.c:
sys/cam/scsi/scsi_da.c:
sys/geom/geom_dev.c:
sys/geom/geom_disk.c:
Use attribute changed events to track updates to physical path
information.

sys/cam/scsi/scsi_da.c:
Add AC_ADVINFO_CHANGED to the registered asynchronous CAM
events for this driver. When this event occurs, and
the updated buffer type references our physical path
attribute, emit a GEOM attribute changed event via the
disk_attr_changed() API.

sys/cam/scsi/scsi_pass.c:
Add AC_ADVINFO_CHANGED to the registered asynchronous CAM
events for this driver. When this event occurs, update
the physical patch devfs alias for this pass instance.

Submitted by: gibbs
Sponsored by: Spectra Logic Corporation

Implement relaxed comparision for hardcoded provider names to make it
ignore adX/adaY difference in both directions to simplify migration to
the CAM-based ATA or back.

Fix deadlock between GEOM class unloading and withering. Withering can't
proceed while g_unload_class() blocks the event thread. Fix this by not
running g_unload_class() as a GEOM event and dropping the topology lock
when withering needs to proceed.

PR: kern/139847
Silence on: freebsd-geom

Fix ddb(4) "show geom addr" command when INVARIANTS is enabled. Don't
assert that the topology lock is held when g_valid_obj() is called from
debugger.

MFC after: 1 week

Log attach just like we log detach.

Fix a panic which (reportedly) can happen when unmounting a filesystem
with I/O requests in flight on kernels compiled with "options INVARIANTS".
Also, make it obvious it's not right to call g_valid_obj() (and macros
using it, e.g. G_VALID_CONSUMER()) without topology lock held.

Approved by: re (kib)
Reported by: pho

Simplify.

- Unbreak 64 bit platforms by casting off_t to intmax.

- Fix wrong print on BIO_DONE.
- Use db_printf instead of printf. While here, apply this to other ddb commands
as well.

Pointed out by: pjd

- Add 'show bio' DDB command.

MFC after: 3 weeks

Revert r190676,190677

The geom and CAM changes for root_hold are the wrong solution for USB design
quirks.

Requested by: scottl

Add interleaving root hold tokens from the CAM probe to disk_create and geom
provider tasting. This is needed for disk attachments that happen after threads
are running in the boot process.

Tested by: rnoland

In g_handleattr(), set bp->bio_completed also for the case
where len is 0. Otherwise g_getattr() will never succeed
when it is handled by g_handleattr_str().

Constify val in g_handleattr() and str in g_handleattr_str().
This allows passing string constants to g_handleattr_str().

- Add missing word in comment.

Add sbuf_new_auto as a shortcut for the very common case of creating a
completely dynamic sbuf.

Obtained from: Varnish
MFC after: 2 weeks

- Assert that we don't send new provider event for a provider which has
G_PF_WITHER flag set.
- Fix typo in assertion condition (sorry, but I forgot who report that).

Play nice with DDB pager.

Educated by: jhb's BSDCan presentation

When retasting, wither any existing GEOMs of the same class. This
allows the class to create a different GEOM for the same provider
as well as avoid that we end up with multiple GEOMs of the same
class with the same name.

For example, when a disk contains a PC98 partition table but
only MBR is supported, then the partition table can be treated
as a MBR. If support for PC98 is later loaded as a module, the
MBR scheme is pre-empted for the PC98 scheme as expected.

Add g_retaste(), which given a class will present all non-open providers
to it for tasting. This is useful when the class, through means outside
the scope of GEOM, can claim providers previously unclaimed.

The g_retaste() function posts an event which is handled by the
g_retaste_event().

Event suggested by: phk

- Implement helper g_handleattr_str() function for string attributes
handling.
- Extend g_handleattr() to treat attribute as string when len=0.

OK'ed by: phk

Add 'show geom [addr]' ddb(4) command, which prints entire GEOM topology if
no additional argument is given or details about the given GEOM object
(class, geom, provider or consumer).

Approved by: phk

Add g_wither_provider() to abstract the details of destroying a
particular provider. Use this function where g_orphan_provider()
is being called so that the flags are updated correctly and
g_orphan_provider() is called only when allowed.

Fix a bug that caused some /dev entries to continue to exist after
the underlying drive had been hot-unplugged from the system. Here
is a specific example. Filesystem code had opened /dev/da1s1e.
Subsequently, the drive was hot-unplugged. This (correctly) caused
all of the associated /dev/da1* entries to be deleted. When the
filesystem later realized that the drive was gone it closed the
device, reducing the write-access counts to 0 on the geom providers
for da1s1e, da1s1, and da1. This caused geom to re-taste the
providers, resulting in the devices being created again. When the
drive was hot-plugged back in, it resulted in duplicate /dev entries
for da1s1e, da1s1, and da1.

This fix adds a new disk_gone() function which is called by CAM when a
drive goes away. It orphans all of the providers associated with the
drive, setting an error condition of ENXIO in each one. In addition,
we prevent a re-taste on last close for writing if an error condition
has been set in the provider.

Sponsored by: Isilon Systems
Reviewed by: phk
MFC after: 1 week

fix a "modify after free" bug which is practically impossible to
experience.

Found by: Coverity (id #540 #541)

Add g_wither_geom_close() function.

Don't call g_waitidle(), it happens automagically now.

- Turn KASSERT()s into warning printf()'s in the g_class_load() routine.
This removes a panic that will occur if you build with GENERIC and
attempt to kldload a GEOM module that is already in the kernel.

Reviewed by: phk

When loading GEOM modules, we expect the actual load process to be done
by the time that kldload(8) returns. Satisfy that by making the GEOM
module load event -- only when the kernel is !cold -- wait until the
GEOM module init function has finished instead of returning immediately.

This is the other half of fixing md(8) (actually, "mfs" in fstab(5))
that is similar to r1.128 of src/sys/dev/md/md.c. This bug would be
why RAM disks would often fail on boot and the first call to mdconfig(8)
would probably fail.

pjd has ideas for not requiring kldload(8) to work synchronously for
control devices that could make this obsolete.

Silence on: -arch

For removable devices without media we set a zero mediasize but a non-zero
sectorsize in order to avoid a lot of checks around various divisions etc.

Enforce the sectorsize being > 0 with a KASSERT on successful open.

Fix scsi_cd.c to return 2k sectors when no media inserted.

OK, now check geom class version numbers.

OOps, that check was a bit premature. Allow zero versions as well.

Give classes a version number and refuse to touch classes which are not
understood. This makes room for additional binary compatibility in the
future.

Put fields in the class for the geom's methods and initialize the methods
of a new geom from these fields. This saves some code in all classes.

Only detach consumers which are attached when we wither stuff away.

Pointed out by: pjd

Make withering water tight.

When we orphan/wither a provider, an attached geom+consumer could
end up being withered as a result and it may be in front of us in
the normal object scanning order so we need to do multi-pass. On
the other hand, there may be withering stuff we can't get rid off
(yet), so we need to keep track of both the existence of withering
stuff and if there is more we can do at this time.

Fail normally rather than KASSERT if attempt to open a spoiled consumer.

Move "is consumer attached?" check before G_VALID_PROVIDER() check,
because if consumer is not attached, its provider never will be valid,
so we never reach this check.

Approved by: phk

Be more insistent on destroying geoms at unload time. Still not perfect,
but it will do (better) for now.

KASSERT that to have providers a class must have an access method.

Tag the new_provider event with the geom as well.

Rearrange some of the GEOM debugging tools to be more structured.

Retire g_sanity() and corresponding debugflag (0x8)

Retire g_{stall,release}_events().

Under #ifdef DIAGNOSTIC:

Make g_valid_obj() an official function and have it return an an
non-zero integer which indicates the kind of object when found.

Implement G_VALID_{CLASS,GEOM,CONSUMER,PROVIDER}() macros based
on g_valid_obj().

Sprinkle calls to these macros liberally over the infrastructure.

Always check that we do not free a live object.

Don't panic on providers already withered when we wither a geom.

Add a KASSERT which checks that a class never fails a closing ->access()
call.

Remove the absolute count g_access_abs() function since experience has
shown that it is not useful.

Rename the relative count g_access_rel() function to g_access(), only
the name has changed.

Change all g_access_rel() calls in our CVS tree to call g_access() instead.

Add an #ifndef BURN_BRIDGES #define of g_access_rel() for source
code compatibility.

Allow a GEOM class to unload if it has no geoms or a method function to
get rid of them.

Prodded by: pjd

- Use proper names in KASSERTs.
- Typos.

Approved by: phk, scottl (mentor)

Add KASSERTS.

Submitted by: Pawel Jakub Dawidek <nick@garage.freebsd.pl>

Plug an insignificant memoryleak.

Submitted by: Pawel Jakub Dawidek <nick@garage.freebsd.pl>

Print the correct pointer in a KASSERT.

Submitted by: Pawel Jakub Dawidek <nick@garage.freebsd.pl>

KASSERT against no-op access requests.

Submitted by: Pawel Jakub Dawidek <nick@garage.freebsd.pl>

Call class->init() an class->fini() while the class is hooked up,
rather than right before and right after. This allows these routines
to manipulate the mesh.

KASSERT that nobody creates a geom on an alien class.

Assert topology in g_valid_obj().

Approved by: re@

This is a crude bandaid for 5.2 to protect against providers which disappear
while being tasted. I can moderately easy trigger this with atapi-cd, but
I do not fully understand the circumstances.

Introduce a per provider wither flag

Don't panic over the fact that unloading failed if we already knew that.

Use __FBSDID().

Approved by: phk

Drop a memory-corruption debugging test-tool.

Add missing va_end() calls.

Noticed by: tmm

Introduce g_provider_by_name() function, and use it.

Add a KASSERT to prevent the same GEOM class from being processed loaded
twice.

Enforce that classes should have different names while we are here.

constify g_sanity()

Introduce a init and fini member functions on a class.

Use ->init() and ->fini() to handle the mutex in geom_disk.c

Remove the g_add_class() function and replace it with a standardized
g_modevent() function.

This adds the basic infrastructure for loading/unloading GEOM classes

Back out all the stuff that didn't belong in the last commit.

Use g_slice_spoiled() rather than g_std_spoiled().

Remember to free the buffer we got from g_read_data().

Rework the "withering" mechanism:

Introduce g_wither_geom() to do the work in one single place.

Remove the now obsolete geomidorname hack.

Remove now unneeded special case for "geom.ctl".

Rename g_call_me() to g_post_event(), and give it a flag
argument to determine if we can M_WAITOK in malloc.

Turn EV_NEW_PROVIDER into a g_call_me() event.

Convert EV_SPOILED event to use g_call_me().

Turn the hardwired NEW_CLASS event into a g_call_me() event.

Remove unused event pointers in object structures.
Remove KASSERTS which checked that they were unused.

Time has run from the "run GEOM in userland" harness, and the new regression
test is built to test GEOM as running in the kernel.

This commit is basically "unifdef -D_KERNEL" to remove the mainly #include
related code to support the userland-harness.

If we hit access ahead of a spoil event, we should have negative
delta access-counts and proceed.

Change events to have an array of "void *" references, and give the
event posting functions varargs to fill these.

Attribute g_call_me() to appropriate g_geom's where necessary.

Add a flag argument to g_call_me() methods which will be used to signal
cancellation of events in the future.

This commit should be a no-op.

Only orphan things if the open/close actually succeeded.

g_class_by_name() was unused too.

Remove unuse g_insert_geom().

Introduce g_cancel_events() and use it a couple of places where it makes
sense.

Retire the GEOM private statistics code and use devstat instead.

Including <sys/stdint.h> is (almost?) universally only to be able to use
%j in printfs, so put a newsted include in <sys/systm.h> where the printf
prototype lives and save everybody else the trouble.

Remove unneeded #include of geom_stats.h

Don't use statistics counters to detect outstanding I/O.

Back out M_* changes, per decision of the TRB.

Approved by: trb

Implement a handle for efficient implementation of perforations in
lower extremities.

Setting bit 4 in debugflags (sysctl kern.geom.debugflags=16) will
allow any open to succeed on rank#1 providers. This will generally
correspond to the physical disk devices: ad0, da0, md0 etc.

This fundamentally violates the mechanics of GEOMs autoconfiguration,
and is only provided as a debugging facility, so obviously error
reports on GEOM where this bit is or has been set will not be
accepted.

Move the g_stat struct to its own .h file, we will export it to other code.

Insted of embedding a struct g_stat in consumers and providers, merely
include a pointer.

Remove a couple of <sys/time.h> includes now unneeded.

Add a special allocator for struct g_stat. This allocator will allocate
entire pages and hand out g_stat functions from there. The "id" field
indicates free/used status.

Add "/dev/geom.stats" device driver whic exports the pages from the
allocator to userland with mmap(2) in read-only mode.

This mmap(2) interface should be considered a non-public interface and
the functions in libgeom (not yet committed) should be used to access
the statistics data.

Commit the correct copy of the g_stat structure.

Add debug.sizeof.g_stat sysctl.

Set the id field of the g_stat when we create consumers and providers.

Remove biocount from consumer, we will use the counters in the g_stat
structure instead. Replace one field which will need to be atomically
manipulated with two fields which will not (stat.nop and stat.nend).

Change add companion field to bio_children: bio_inbed for the exact
same reason.

Don't output the biocount in the confdot output.

Fix KASSERT in g_io_request().

Add sysctl kern.geom.collectstats defaulting to off.

Collect the following raw statistics conditioned on this sysctl:

for each consumer and provider {
total number of operations started.
total number of operations completed.
time last operation completed.
sum of idle-time.
for each of BIO_READ, BIO_WRITE and BIO_DELETE {
number of operations completed.
number of bytes completed.
number of ENOMEM errors.
number of other errors.
sum of transaction time.
}
}

API for getting hold of these statistics data not included yet.

Rename bio_linkage to the more obvious bio_parent.
Add bio_t0 timestamp, and include <sys/time.h> where needed

Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.
Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.

We should not need to hold Giant for sbuf operations any more.

Constification and some s/int/u_int/ changes.

Straighten up the geom.ctl config interface definitions.

Sponsored by: DARPA & NAI Labs

Polish a bit here and there.
Reenable the geom.ctl device so people can play with gbde.

Sponsored by: DARPA & NAI Labs

Use a better test to prevent tasting geom.ctl so we don't screw the
regression tests.

Don't taste the first provider, it's /dev/geom.ctl and it's not going
to taste like anything we like anyway.

The g_id*() functions are not needed in the userland test-suite so
#ifdef _KERNEL them rather than deal with a copyin simulation.

Sponsored by: DARPA & NAI Labs

Use %jd instead of %lld now that we have it.

Implement the GEOMCONFIGGEOM ioctl which can be used to manually create
and configure an instance of a class on a give provider.

Sponsored by: DARPA & NAI Labs

Add support g_clone_bio() and g_std_done() to spawn multiple children
of a bio and correctly gather status when done.

Sponsored by: DARPA & NAI Labs.

Retire g_io_fail() and let g_io_deliver() take an error argument instead.

Sponsored by: DARPA & NAI Labs.

Disable the g_sanity() check unless people ask for it in the debugflags.

Sponsored by: DARPA & NAI Labs.

Remove "magicspace". It looks good on paper, it doesn't work in practice.

Sponsored by: DARPA & NAI Labs.

Improve some on the naming.

Submitted by: iedowse

Change the registration of magic spaces so it does its own memory management.

Sponsored by: DARPA & NAI Labs.

Introduce the concept of "magic spaces", and implement them in most of
the relevant classes.

Some methods may implement various "magic spaces", this is reserved
or magic areas on the disk, set a side for various and sundry purposes.
A good example is the BSD disklabel and boot code on i386 which occupies
a total of four magic spaces: boot1, the disklabel, the padding behind
the disklabel and boot2. The reason we don't simply tell people to
write the appropriate stuff on the underlying device is that (some of)
the magic spaces might be real-time modifiable. It is for instance
possible to change a disklabel while partitions are open, provided
the open partitions do not get trampled in the process.

Sponsored by: DARPA & NAI Labs.

Fix a {} bug which doesn't have any effect yet.

Spotted by: jake

Introduce some serious paranoia to try to catch a memory overwrite problem
as early as possible.

Sponsored by: DARPA & NAI Labs

Introduce the convenience function g_getattr() and make it DWIM.

Sponsored by: DARPA & NAI Labs.

Move access and orphan member functions from class to geom.

Sponsored by: DARPA & NAI Labs

s/classs/classes/ to fixup grammer after the previous global renaming.

Sponsored by: DARPA & NAI Labs

In the absense of any smarter way to do this, cast various printf
arguments to silence printf format warnings.

Eliminate some thread pointers which do not make sense anymore.

Split private parts of geom.h into geom_int.h. The latter should
never be included in class implemtations.

Cave in to tradition and rename "methods" to "classes".

First commit of the GEOM subsystem to make it easier for people to
test and play with this.

This is not yet production quality and should be run only on dedicated
test boxes.

For people who want to develop transformations for GEOM there exist a
set of shims to run geom in userland (ask phk@freebsd.org).

Reports of all kinds to: phk@freebsd.org
Please include in report:
dmesg
sysctl debug.geomdot
sysctl debug.geomconf

Known significant limitations:
no kernel dump facility.
ioctls severely restricted.

Sponsored by: DARPA, NAI Labs