kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restricti

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restrictions
are inherited by sub-processes recursively. Once set, restrictions cannot
be removed.

Basic restrictions that mimic an unadorned jail can be enabled without
creating a jail, but generally speaking real security also requires
creating a chrooted filesystem topology, and a jail is still needed
to really segregate processes from each other. If you do so, however,
you can (for example) disable mount/umount and most global root-only
features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
improve jailess security in the near future, and to optimize the
priv_check code.

show more ...

kernel/drmP.h: Use Linux' __printf() macro.

drm/radeon: Remove some unused code.

The last usage of it was removed in 857ba049f77abf52192114507b738ab0.

Reported-by: Sergey Zigachev <s.zi@outlook.com>

drm - restore idr_alloc() functionality from amdgpu

* Restore idr_alloc() functionality

* Fix the IDA initializer to properly initialize the lwkt_token.

In-conversation-with: hjarvard

kernel: Fix LINT64 build.

* Add a needed file to sys/conf/files.

* Shield the drm code from 'DEBUG' being defined via opt_global.h (DEBUG
is a kernel configuration option). This was breaking amdg

kernel: Fix LINT64 build.

* Add a needed file to sys/conf/files.

* Shield the drm code from 'DEBUG' being defined via opt_global.h (DEBUG
is a kernel configuration option). This was breaking amdgpu's atom.c
that defines its own 'DEBUG' macro.

show more ...

drm/ttm: Update to match amdgpu driver, Linux 4.19 based

drm/amdgpu: Port to DragonFly

* This commit does not build as it requires ttm changes from
the corresponding commit

Amdgpu driver changes:
* Builds with CONFIG_DRM_AMD_DC and CONFIG_DRM_AMD_DC_DC

drm/amdgpu: Port to DragonFly

* This commit does not build as it requires ttm changes from
the corresponding commit

Amdgpu driver changes:
* Builds with CONFIG_DRM_AMD_DC and CONFIG_DRM_AMD_DC_DCN1_0 defined
* Support for older GPUs (SI, CIK) is not implemented
* Several functions for display core module require msse and
mhard-float gcc flags to be set; and they require special
treatment from kernel by utilizing kernel_fpu_begin/kernel_fpu_end
functions
* It is required that tunable set amdgpu_hw_i2c=1 to work around
panic during module load
* Thunderbolt support is disabled
* Amdgpu trace infrastructure replaced by a stub

Drm changes:
* register_framebuffer is called at the later stage, after crtcs
were properly initialized
* drm_close implemented
* drm_connector_update_edid_property implemented
* Fix drm device stays locked in case of an error or module shutdown
* Imported drm gem framebuffer helper functions
* Fixed null pointer deref in the drm mmap ioctl
* Imported atomic64_inc and atomic_long_* functions from Linux
* Imported bitmap_complement function from Linux
* Imported kfifo struct from Linux
* Implemented dma fence array properly
* Imported rb_root_cached struct from Linux
* Implemented several dma fence functions

Co-authored-by: François Tigeot <ftigeot@wolfpond.org>
Co-authored-by: Matthew Dillon <dillon@apollo.backplane.com>

show more ...

drm: Import the amdgpu driver from Linux 4.19