MFH

Sponsored by:	The FreeBSD Foundation

12 files changed, 1103 insertions, 12 deletions

diff --git a/share/dtrace/Makefile b/share/dtrace/Makefile
index a4bb4e6..83bc48e 100644
--- a/share/dtrace/Makefile
+++ b/share/dtrace/Makefile
@@ -22,7 +22,10 @@ SCRIPTS=	blocking \
 		tcpconn \
 		tcpstate \
 		tcptrack \
-		udptrack
+		udptrack \
+		watch_execve \
+		watch_kill \
+		watch_vop_remove
 
 SCRIPTSDIR= ${SHAREDIR}/dtrace
 
diff --git a/share/dtrace/watch_execve b/share/dtrace/watch_execve
new file mode 100755
index 0000000..1817d4b
--- /dev/null
+++ b/share/dtrace/watch_execve
@@ -0,0 +1,227 @@
+#!/usr/sbin/dtrace -s
+/* -
+ * Copyright (c) 2014 Devin Teske <dteske@FreeBSD.org>
+ * All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Title: dtrace(1) script to log process(es) entering syscall::execve $
+ * $FreeBSD$
+ */
+
+#pragma D option quiet
+#pragma D option dynvarsize=16m
+#pragma D option switchrate=10hz
+
+/*********************************************************/
+
+syscall::execve:entry /* probe ID 1 */
+{
+	this->caller_execname = execname;
+}
+
+/*********************************************************/
+
+syscall::execve:return /execname != this->caller_execname/ /* probe ID 2 */
+{
+	/*
+	 * Examine process, parent process, and grandparent process details
+	 */
+
+	/******************* CURPROC *******************/
+
+	this->proc = curthread->td_proc;
+	this->pid0 = this->proc->p_pid;
+	this->uid0 = this->proc->p_ucred->cr_uid;
+	this->gid0 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc->p_args;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg0_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* PPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid1 = this->proc->p_pid;
+	this->uid1 = this->proc->p_ucred->cr_uid;
+	this->gid1 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg1_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* GPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid2 = this->proc->p_pid;
+	this->uid2 = this->proc->p_ucred->cr_uid;
+	this->gid2 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg2_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* APARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid3 = this->proc->p_pid;
+	this->uid3 = this->proc->p_ucred->cr_uid;
+	this->gid3 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg3_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_4 = this->ar_length > 0 ? "..." : "";
+
+	/***********************************************/
+
+	/*
+	 * Print process, parent, and grandparent details
+	 */
+
+	printf("%Y %s[%d]: ", timestamp + 1406598400000000000,
+		this->caller_execname, this->pid1);
+	printf("%s", this->arg0_0);
+	printf("%s%s", this->arg0_1 != "" ? " " : "", this->arg0_1);
+	printf("%s%s", this->arg0_2 != "" ? " " : "", this->arg0_2);
+	printf("%s%s", this->arg0_3 != "" ? " " : "", this->arg0_3);
+	printf("%s%s", this->arg0_4 != "" ? " " : "", this->arg0_4);
+	printf("\n");
+
+	printf(" -+= %05d %d.%d %s",
+		this->pid3, this->uid3, this->gid3, this->arg3_0);
+	printf("%s%s", this->arg3_1 != "" ? " " : "", this->arg3_1);
+	printf("%s%s", this->arg3_2 != "" ? " " : "", this->arg3_2);
+	printf("%s%s", this->arg3_3 != "" ? " " : "", this->arg3_3);
+	printf("%s%s", this->arg3_4 != "" ? " " : "", this->arg3_4);
+	printf("%s", this->arg3_0 != "" ? "\n" : "");
+
+	printf("  \-+= %05d %d.%d %s",
+		this->pid2, this->uid2, this->gid2, this->arg2_0);
+	printf("%s%s", this->arg2_1 != "" ? " " : "", this->arg2_1);
+	printf("%s%s", this->arg2_2 != "" ? " " : "", this->arg2_2);
+	printf("%s%s", this->arg2_3 != "" ? " " : "", this->arg2_3);
+	printf("%s%s", this->arg2_4 != "" ? " " : "", this->arg2_4);
+	printf("%s", this->arg2_0 != "" ? "\n" : "");
+
+	printf("    \-+= %05d %d.%d %s",
+		this->pid1, this->uid1, this->gid1, this->arg1_0);
+	printf("%s%s", this->arg1_1 != "" ? " " : "", this->arg1_1);
+	printf("%s%s", this->arg1_2 != "" ? " " : "", this->arg1_2);
+	printf("%s%s", this->arg1_3 != "" ? " " : "", this->arg1_3);
+	printf("%s%s", this->arg1_4 != "" ? " " : "", this->arg1_4);
+	printf("%s", this->arg1_0 != "" ? "\n" : "");
+
+	printf("      \-+= %05d %d.%d %s",
+		this->pid0, this->uid0, this->gid0, this->arg0_0);
+	printf("%s%s", this->arg0_1 != "" ? " " : "", this->arg0_1);
+	printf("%s%s", this->arg0_2 != "" ? " " : "", this->arg0_2);
+	printf("%s%s", this->arg0_3 != "" ? " " : "", this->arg0_3);
+	printf("%s%s", this->arg0_4 != "" ? " " : "", this->arg0_4);
+	printf("%s", this->arg0_0 != "" ? "\n" : "");
+}
diff --git a/share/dtrace/watch_kill b/share/dtrace/watch_kill
new file mode 100755
index 0000000..46f3cd8
--- /dev/null
+++ b/share/dtrace/watch_kill
@@ -0,0 +1,232 @@
+#!/usr/sbin/dtrace -s
+/* -
+ * Copyright (c) 2014-2016 Devin Teske <dteske@FreeBSD.org>
+ * All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Title: dtrace(1) script to log process(es) entering syscall::kill $
+ * $FreeBSD$
+ */
+
+#pragma D option quiet
+#pragma D option dynvarsize=16m
+#pragma D option switchrate=10hz
+
+/*********************************************************/
+
+syscall::execve:entry /* probe ID 1 */
+{
+	this->caller_execname = execname;
+}
+
+/*********************************************************/
+
+syscall::kill:entry /* probe ID 2 */
+{
+	this->pid_to_kill = (pid_t)arg0;
+	this->kill_signal = (int)arg1;
+
+	/*
+	 * Examine process, parent process, and grandparent process details
+	 */
+
+	/******************* CURPROC *******************/
+
+	this->proc = curthread->td_proc;
+	this->pid0 = this->proc->p_pid;
+	this->uid0 = this->proc->p_ucred->cr_uid;
+	this->gid0 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc->p_args;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg0_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* PPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid1 = this->proc->p_pid;
+	this->uid1 = this->proc->p_ucred->cr_uid;
+	this->gid1 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg1_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* GPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid2 = this->proc->p_pid;
+	this->uid2 = this->proc->p_ucred->cr_uid;
+	this->gid2 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg2_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* APARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid3 = this->proc->p_pid;
+	this->uid3 = this->proc->p_ucred->cr_uid;
+	this->gid3 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg3_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg3_4 = this->ar_length > 0 ? "..." : "";
+
+	/***********************************************/
+
+	/*
+	 * Print process, parent, and grandparent details
+	 */
+
+	printf("%Y %s[%d]: ", timestamp + 1406598400000000000,
+		this->caller_execname, this->pid1);
+	printf("%s", this->arg0_0);
+	printf("%s%s", this->arg0_1 != "" ? " " : "", this->arg0_1);
+	printf("%s%s", this->arg0_2 != "" ? " " : "", this->arg0_2);
+	printf("%s%s", this->arg0_3 != "" ? " " : "", this->arg0_3);
+	printf("%s%s", this->arg0_4 != "" ? " " : "", this->arg0_4);
+	printf(" (sending signal %u to pid %u)",
+		this->kill_signal, this->pid_to_kill);
+	printf("\n");
+
+	printf(" -+= %05d %d.%d %s",
+		this->pid3, this->uid3, this->gid3, this->arg3_0);
+	printf("%s%s", this->arg3_1 != "" ? " " : "", this->arg3_1);
+	printf("%s%s", this->arg3_2 != "" ? " " : "", this->arg3_2);
+	printf("%s%s", this->arg3_3 != "" ? " " : "", this->arg3_3);
+	printf("%s%s", this->arg3_4 != "" ? " " : "", this->arg3_4);
+	printf("%s", this->arg3_0 != "" ? "\n" : "");
+
+	printf("  \-+= %05d %d.%d %s",
+		this->pid2, this->uid2, this->gid2, this->arg2_0);
+	printf("%s%s", this->arg2_1 != "" ? " " : "", this->arg2_1);
+	printf("%s%s", this->arg2_2 != "" ? " " : "", this->arg2_2);
+	printf("%s%s", this->arg2_3 != "" ? " " : "", this->arg2_3);
+	printf("%s%s", this->arg2_4 != "" ? " " : "", this->arg2_4);
+	printf("%s", this->arg2_0 != "" ? "\n" : "");
+
+	printf("    \-+= %05d %d.%d %s",
+		this->pid1, this->uid1, this->gid1, this->arg1_0);
+	printf("%s%s", this->arg1_1 != "" ? " " : "", this->arg1_1);
+	printf("%s%s", this->arg1_2 != "" ? " " : "", this->arg1_2);
+	printf("%s%s", this->arg1_3 != "" ? " " : "", this->arg1_3);
+	printf("%s%s", this->arg1_4 != "" ? " " : "", this->arg1_4);
+	printf("%s", this->arg1_0 != "" ? "\n" : "");
+
+	printf("      \-+= %05d %d.%d %s",
+		this->pid0, this->uid0, this->gid0, this->arg0_0);
+	printf("%s%s", this->arg0_1 != "" ? " " : "", this->arg0_1);
+	printf("%s%s", this->arg0_2 != "" ? " " : "", this->arg0_2);
+	printf("%s%s", this->arg0_3 != "" ? " " : "", this->arg0_3);
+	printf("%s%s", this->arg0_4 != "" ? " " : "", this->arg0_4);
+	printf("%s", this->arg0_0 != "" ? "\n" : "");
+}
diff --git a/share/dtrace/watch_vop_remove b/share/dtrace/watch_vop_remove
new file mode 100755
index 0000000..6a5e7c4
--- /dev/null
+++ b/share/dtrace/watch_vop_remove
@@ -0,0 +1,476 @@
+#!/usr/sbin/dtrace -s
+/* -
+ * Copyright (c) 2014 Devin Teske <dteske@FreeBSD.org>
+ * All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Title: dtrace(1) script to log process(es) entering vfs::vop_remove $
+ * $FreeBSD$
+ */
+
+#pragma D option quiet
+#pragma D option dynvarsize=16m
+#pragma D option switchrate=10hz
+
+/*********************************************************/
+
+vfs::vop_remove:entry /* probe ID 1 */
+{
+	this->vp = (struct vnode *)arg0;
+	this->ncp = &(this->vp->v_cache_dst) != NULL ?
+		this->vp->v_cache_dst.tqh_first : 0;
+        this->fi_name = args[1] ? (
+		args[1]->a_cnp != NULL ?
+			stringof(args[1]->a_cnp->cn_nameptr) : ""
+	) : "";
+	this->mount = this->vp->v_mount; /* ptr to vfs we are in */
+	this->fi_fs = this->mount != 0 ?
+		stringof(this->mount->mnt_stat.f_fstypename) : "";
+	this->fi_mount = this->mount != 0 ?
+		stringof(this->mount->mnt_stat.f_mntonname) : "";
+	this->d_name = args[0]->v_cache_dd != NULL ?
+		stringof(args[0]->v_cache_dd->nc_name) : "";
+}
+
+vfs::vop_remove:entry /this->vp == 0 || this->fi_fs == 0 ||
+	this->fi_fs == "devfs" || this->fi_fs == "" ||
+	this->fi_name == ""/ /* probe ID 2 */
+{
+	this->ncp = 0;
+}
+
+/*********************************************************/
+
+vfs::vop_remove:entry /this->ncp/ /* probe ID 3 (depth 1) */
+{
+	this->dvp = this->ncp->nc_dvp != NULL ? (
+		&(this->ncp->nc_dvp->v_cache_dst) != NULL ?
+			this->ncp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name1 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->name1 == 0 || this->fi_fs == 0 ||
+	this->fi_fs == "devfs" || this->fi_fs == "" ||
+	this->name1 == "/" || this->name1 == ""/ /* probe ID 4 */
+{
+	this->dvp = 0;
+}
+
+/*********************************************************/
+
+/*
+ * BEGIN Pathname-depth iterators (copy/paste as many times as-desired)
+ */
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 5 (depth 2) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name2 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 6 (depth 3) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name3 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 7 (depth 4) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name4 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 8 (depth 5) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name5 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 9 (depth 6) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name6 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 10 (depth 7) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name7 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 11 (depth 8) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name8 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 12 (depth 9) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name9 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 13 (depth 10) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name10 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 14 (depth 11) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name11 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 15 (depth 12) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name12 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 16 (depth 13) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name13 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 17 (depth 14) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name14 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 18 (depth 15) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name15 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 19 (depth 16) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name16 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 20 (depth 17) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name17 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 21 (depth 18) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name18 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 22 (depth 19) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name19 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+vfs::vop_remove:entry /this->dvp/ /* probe ID 23 (depth 20) */
+{
+	this->dvp = this->dvp->nc_dvp != NULL ? (
+		&(this->dvp->nc_dvp->v_cache_dst) != NULL ?
+			this->dvp->nc_dvp->v_cache_dst.tqh_first : 0
+	) : 0;
+	this->name20 = this->dvp != 0 ? (
+		this->dvp->nc_name != 0 ? stringof(this->dvp->nc_name) : ""
+	) : "";
+}
+
+/*
+ * END Pathname-depth iterators
+ */
+
+/*********************************************************/
+
+vfs::vop_remove:entry /this->fi_mount != 0/ /* probe ID 24 */
+{
+	printf("%Y %s[%d]: ", timestamp + 1406598400000000000, execname, pid);
+
+	/*
+	 * Print full path of file to delete
+	 * NB: Up-to but not including the parent directory (printed below)
+	 */
+	printf("%s%s", this->fi_mount, this->fi_mount != 0 ? (
+		this->fi_mount == "/" ? "" : "/"
+	) : "/");
+	printf("%s%s", this->name = this->name20, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name19, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name18, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name17, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name16, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name15, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name14, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name13, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name12, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name11, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name10, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name9, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name8, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name7, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name6, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name5, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name4, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name3, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name2, this->name != "" ? "/" : "");
+	printf("%s%s", this->name = this->name1, this->name != "" ? "/" : "");
+
+	/* Print the parent directory name */
+	this->name = this->d_name != 0 ? this->d_name : "";
+	printf("%s%s", this->name, this->name != "" ? "/" : "");
+
+	/* Print the entry name */
+	this->name = this->fi_name != 0 ? this->fi_name : "";
+	printf("%s", this->name);
+
+	printf("\n");
+
+	/*
+	 * Examine process, parent process, and grandparent process details
+	 */
+
+	/******************* CURPROC *******************/
+
+	this->proc = curthread->td_proc;
+	this->pid0 = this->proc->p_pid;
+	this->uid0 = this->proc->p_ucred->cr_uid;
+	this->gid0 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc->p_args;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg0_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg0_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* PPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid1 = this->proc->p_pid;
+	this->uid1 = this->proc->p_ucred->cr_uid;
+	this->gid1 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg1_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg1_4 = this->ar_length > 0 ? "..." : "";
+
+	/******************* GPARENT *******************/
+
+	this->proc = this->proc->p_pptr;
+	this->pid2 = this->proc->p_pid;
+	this->uid2 = this->proc->p_ucred->cr_uid;
+	this->gid2 = this->proc->p_ucred->cr_rgid;
+	this->p_args = this->proc ? this->proc->p_args : 0;
+	this->ar_length = this->p_args ? this->p_args->ar_length : 0;
+	this->ar_args = (char *)(this->p_args ? this->p_args->ar_args : 0);
+
+	this->arg2_0 = this->ar_length > 0 ?
+		this->ar_args : stringof(this->proc->p_comm);
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_1 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_2 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_3 = this->ar_length > 0 ? this->ar_args : "";
+	this->len = this->ar_length > 0 ? strlen(this->ar_args) + 1 : 0;
+	this->ar_args += this->len;
+	this->ar_length -= this->len;
+
+	this->arg2_4 = this->ar_length > 0 ? "..." : "";
+
+	/***********************************************/
+
+	/*
+	 * Print process, parent, and grandparent details
+	 */
+
+	printf(" -+= %05d %d.%d %s",
+		this->pid2, this->uid2, this->gid2, this->arg2_0);
+	printf("%s%s", this->arg2_1 != "" ? " " : "", this->arg2_1);
+	printf("%s%s", this->arg2_2 != "" ? " " : "", this->arg2_2);
+	printf("%s%s", this->arg2_3 != "" ? " " : "", this->arg2_3);
+	printf("%s%s", this->arg2_4 != "" ? " " : "", this->arg2_4);
+	printf("%s", this->arg2_0 != "" ? "\n" : "");
+
+	printf("  \-+= %05d %d.%d %s",
+		this->pid1, this->uid1, this->gid1, this->arg1_0);
+	printf("%s%s", this->arg1_1 != "" ? " " : "", this->arg1_1);
+	printf("%s%s", this->arg1_2 != "" ? " " : "", this->arg1_2);
+	printf("%s%s", this->arg1_3 != "" ? " " : "", this->arg1_3);
+	printf("%s%s", this->arg1_4 != "" ? " " : "", this->arg1_4);
+	printf("%s", this->arg1_0 != "" ? "\n" : "");
+
+	printf("    \-+= %05d %d.%d %s",
+		this->pid0, this->uid0, this->gid0, this->arg0_0);
+	printf("%s%s", this->arg0_1 != "" ? " " : "", this->arg0_1);
+	printf("%s%s", this->arg0_2 != "" ? " " : "", this->arg0_2);
+	printf("%s%s", this->arg0_3 != "" ? " " : "", this->arg0_3);
+	printf("%s%s", this->arg0_4 != "" ? " " : "", this->arg0_4);
+	printf("%s", this->arg0_0 != "" ? "\n" : "");
+}
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index d962d38..f9c3adb 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -96,6 +96,7 @@ MAN=	aac.4 \
 	${_ccd.4} \
 	cd.4 \
 	cdce.4 \
+	cfi.4 \
 	ch.4 \
 	ciss.4 \
 	cloudabi.4 \
@@ -594,6 +595,7 @@ MLINKS+=bwn.4 if_bwn.4
 MLINKS+=${_bxe.4} ${_if_bxe.4}
 MLINKS+=cas.4 if_cas.4
 MLINKS+=cdce.4 if_cdce.4
+MLINKS+=cfi.4 cfid.4
 MLINKS+=cloudabi.4 cloudabi64.4
 MLINKS+=crypto.4 cryptodev.4
 MLINKS+=cue.4 if_cue.4
diff --git a/share/man/man4/cfi.4 b/share/man/man4/cfi.4
new file mode 100644
index 0000000..c5a9703
--- /dev/null
+++ b/share/man/man4/cfi.4
@@ -0,0 +1,94 @@
+.\"-
+.\" Copyright (c) 2015-2016 SRI International
+.\" All rights reserved.
+.\"
+.\" This software was developed by SRI International and the University of
+.\" Cambridge Computer Laboratory under DARPA/AFRL contract (FA8750-10-C-0237)
+.\" ("CTSRD"), as part of the DARPA CRASH research programme.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd January 20, 2016
+.Dt CFI 4
+.Os
+.Sh NAME
+.Nm cfi ,
+.Nm cfid
+.Nd driver for Common Flash Interface (CFI) NOR flash
+.Sh SYNOPSIS
+.Cd "device cfi"
+.Cd "device cfid"
+.Cd "options CFI_SUPPORT_STRATAFLASH"
+.Cd "options CFI_ARMEDANDDANGEROUS"
+.Pp
+In
+.Pa /boot/device.hints :
+.Cd hint.cfi.0.at="nexus0"
+.Cd hint.cfi.0.maddr=0x74000000
+.Cd hint.cfi.0.msize=0x4000000
+.Pp
+In DTS file:
+.Cd flash@74000000 {
+.Cd "	compatible =" Qo cfi-flash Qc ;
+.Cd "	reg = <0x74000000 0x4000000>;"
+.Cd };
+.Sh DESCRIPTION
+The
+.Nm
+device driver provides a management interface to NOR flash devices supporting
+the Common Flash Interface (CFI) specification.
+Its companion device
+.Nm cfid
+provides a
+.Xr geom 4
+disk interface to the device.
+.Pp
+Special support for features of the Intel StrataFlash line are available
+with the
+.Cd CFI_SUPPORT_STRATAFLASH
+kernel option.
+Additional support for write-once bits to switch part of Intel StrataFlash
+devices to read-only can be enabled by the
+.Cd CFI_ARMEDANDDANGEROUS
+kernel option.
+.El
+.Sh SEE ALSO
+.Xr led 4
+.Sh HISTORY
+The
+.Nm
+device driver first appeared in
+.Fx 8.0 .
+.Sh AUTHORS
+The
+.Nm
+driver was written by
+.An Juniper Networks
+with StrataFlash support by
+.An Sam Leffler .
+This manual page was written by SRI International and the University of
+Cambridge Computer Laboratory under DARPA/AFRL contract
+.Pq FA8750-10-C-0237
+.Pq Do CTSRD Dc ,
+as part of the DARPA CRASH research programme.
diff --git a/share/man/man4/lagg.4 b/share/man/man4/lagg.4
index da070f1..c1a1bef 100644
--- a/share/man/man4/lagg.4
+++ b/share/man/man4/lagg.4
@@ -16,7 +16,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd November 6, 2015
+.Dd January 23, 2016
 .Dt LAGG 4
 .Os
 .Sh NAME
@@ -110,6 +110,11 @@ available, the VLAN tag, and the IP source and destination address.
 Distributes outgoing traffic using a round-robin scheduler
 through all active ports and accepts incoming traffic from
 any active port.
+Using
+.Ic roundrobin
+mode can cause unordered packet arrival at the client.
+Throughput might be limited as the client performs CPU-intensive packet
+reordering.
 .It Ic broadcast
 Sends frames to all ports of the LAG and receives frames on
 any port of the LAG.
@@ -161,6 +166,19 @@ Gigabit Ethernet interfaces:
 	192.168.1.1 netmask 255.255.255.0
 .Ed
 .Pp
+Create a link aggregation using ROUNDROBIN with two 
+.Xr bge 4
+Gigabit Ethernet interfaces and set the limit of 500 packets
+per interface:
+.Bd -literal -offset indent
+# ifconfig bge0 up
+# ifconfig bge1 up
+# ifconfig lagg0 create
+# ifconfig lagg0 laggproto roundrobin laggport bge0 laggport bge1 \e
+	192.168.1.1 netmask 255.255.255.0
+# ifconfig lagg0 rr_limit 500
+.Ed
+.Pp
 The following example uses an active failover interface to set up roaming
 between wired and wireless networks using two network devices.
 Whenever the wired master interface is unplugged, the wireless failover
diff --git a/share/man/man4/mod_cc.4 b/share/man/man4/mod_cc.4
index f5f4493..4712a39 100644
--- a/share/man/man4/mod_cc.4
+++ b/share/man/man4/mod_cc.4
@@ -30,7 +30,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd January 12, 2015
+.Dd January 21, 2016
 .Dt MOD_CC 4
 .Os
 .Sh NAME
@@ -49,7 +49,9 @@ using the
 facility.
 .Pp
 The default algorithm is NewReno, and all connections use the default unless
-explicitly overridden using the TCP_CONGESTION socket option (see
+explicitly overridden using the
+.Dv TCP_CONGESTION
+socket option (see
 .Xr tcp 4
 for details).
 The default can be changed using a
@@ -57,6 +59,14 @@ The default can be changed using a
 MIB variable detailed in the
 .Sx MIB Variables
 section below.
+.Pp
+Algorithm specific parameters can be set or queried using the
+.Dv TCP_CCALGOOPT
+socket option (see
+.Xr tcp 4
+for details).
+Callers must pass a pointer to an algorithm specific data, and specify
+its size.
 .Sh MIB Variables
 The framework exposes the following variables in the
 .Va net.inet.tcp.cc
diff --git a/share/man/man4/tcp.4 b/share/man/man4/tcp.4
index 8c5887f..de993e7 100644
--- a/share/man/man4/tcp.4
+++ b/share/man/man4/tcp.4
@@ -34,7 +34,7 @@
 .\"     From: @(#)tcp.4	8.1 (Berkeley) 6/5/93
 .\" $FreeBSD$
 .\"
-.Dd October 27, 2015
+.Dd January 21, 2016
 .Dt TCP 4
 .Os
 .Sh NAME
@@ -137,6 +137,11 @@ send window size,
 receive window size,
 and
 bandwidth-controlled window space.
+.It Dv TCP_CCALGOOPT
+Set or query congestion control algorithm specific parameters.
+See
+.Xr mod_cc 4
+for details.
 .It Dv TCP_CONGESTION
 Select or query the congestion control algorithm that TCP will use for the
 connection.
diff --git a/share/man/man5/ext2fs.5 b/share/man/man5/ext2fs.5
index 00be16f..db792bb 100644
--- a/share/man/man5/ext2fs.5
+++ b/share/man/man5/ext2fs.5
@@ -26,12 +26,12 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 1, 2013
+.Dd January 23, 2016
 .Dt EXT2FS 5
 .Os
 .Sh NAME
 .Nm ext2fs
-.Nd "Ext2fs file system"
+.Nd "ext2/ext3/ext4 file system"
 .Sh SYNOPSIS
 To link into the kernel:
 .Bd -ragged -offset indent
@@ -47,8 +47,14 @@ The
 driver will permit the
 .Fx
 kernel to access
-.Tn Ext2
+.Tn ext2 ,
+.Tn ext3 ,
+and
+.Tn ext4
 file systems.
+The
+.Tn ext4
+support is read-only.
 .Sh EXAMPLES
 To mount a
 .Nm
diff --git a/share/man/man9/hashinit.9 b/share/man/man9/hashinit.9
index b72cd75..65ef10e 100644
--- a/share/man/man9/hashinit.9
+++ b/share/man/man9/hashinit.9
@@ -25,7 +25,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 10, 2004
+.Dd January 23, 2016
 .Dt HASHINIT 9
 .Os
 .Sh NAME
@@ -102,9 +102,11 @@ Any malloc performed by the
 .Fn hashinit_flags
 function will not be allowed to wait, and therefore may fail.
 .It Dv HASH_WAITOK
-Any malloc performed by the
+Any malloc performed by
 .Fn hashinit_flags
 function is allowed to wait for memory.
+This is also the behavior of
+.Fn hashinit .
 .El
 .Sh IMPLEMENTATION NOTES
 The largest prime hash value chosen by
diff --git a/share/man/man9/mod_cc.9 b/share/man/man9/mod_cc.9
index f1cd5be..05205ed 100644
--- a/share/man/man9/mod_cc.9
+++ b/share/man/man9/mod_cc.9
@@ -31,7 +31,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 26, 2014
+.Dd January 21, 2016
 .Dt MOD_CC 9
 .Os
 .Sh NAME
@@ -40,7 +40,8 @@
 .Nm CCV
 .Nd Modular Congestion Control
 .Sh SYNOPSIS
-.In netinet/cc.h
+.In netinet/tcp.h
+.In netinet/tcp_cc.h
 .In netinet/cc/cc_module.h
 .Fn DECLARE_CC_MODULE "ccname" "ccalgo"
 .Fn CCV "ccv" "what"
@@ -74,6 +75,7 @@ struct cc_algo {
 	void	(*cong_signal) (struct cc_var *ccv, uint32_t type);
 	void	(*post_recovery) (struct cc_var *ccv);
 	void	(*after_idle) (struct cc_var *ccv);
+	int	(*ctl_output)(struct cc_var *, struct sockopt *, void *);
 };
 .Ed
 .Pp
@@ -166,6 +168,20 @@ function is called when data transfer resumes after an idle period.
 It should be implemented to adjust state as required.
 .Pp
 The
+.Va ctl_output
+function is called when
+.Xr getsockopt 2
+or
+.Xr setsockopt 2
+is called on a
+.Xr tcp 4
+socket with the
+.Va struct sockopt
+pointer forwarded unmodified from the TCP control, and a
+.Va void *
+pointer to algorithm specific argument.
+.Pp
+The
 .Fn DECLARE_CC_MODULE
 macro provides a convenient wrapper around the
 .Xr DECLARE_MODULE 9