make path matching in devfs rules consistent and sane (and safer)

Before this change path matching had the following features:
- for device nodes the patterns were matched against full path
- in the above case '/' in a path could be matched by a wildcard
- for directories and links only the last component was matched

So, for example, a pattern like 're*' could match the following entries:
- re0 device
- responder/u0 device
- zvol/recpool directory

Although it was possible to work around this behavior (once it was spotted
and understood), it was very confusing and contrary to documentation.

Now we always match a full path for all types of devfs entries (devices,
directories, links) and a '/' has to be matched explicitly.
This behavior follows the shell globbing rules.

This change is originally developed by Jaakko Heinonen.
Many thanks!

PR:		kern/122838
Submitted by:	jh
MFC after:	4 weeks
Style issue in r253661.

Pointed out by:	avg
MFC after:	1 month
fix UPDATING entry in r253677

MFC after:	3 weeks
X-MFC with:	r253677
Implement certificate verification, and many other SSL-related
imrovements; complete details in the PR.

PR:		kern/175514
Submitted by:	Michael Gmelin <freebsd@grem.de>
MFC after:	1 week
 - Use kmem_malloc rather than kmem_alloc() for GDT/LDT/tss allocations etc.
   This eliminates some unusual uses of that API in favor of more typical
   uses of kmem_malloc().

Discussed with:	kib/alc
Tested by:	pho
Sponsored by:	EMC / Isilon Storage Division
Break out the static, global LACP debug options into a per-lagg unit
sysctl tree.

* Create a net.link.lagg.X.lacp node
* Add a debug node under that for tx_test and rx_test
* Add lacp_strict_mode, defaulting to 1

tx_test and rx_test are still a bitmap of unit numbers for now.
At some point it would be nice to create child nodes of the lagg bundle
for each sub-interface, and then populate those with various knobs
and statistics.

Sponsored by:	Netflix
Reserve room for ioctls that aren't in this copy of the driver yet.
Make the BSD-licensed patch the default.

The BSD-licensed patch(1) command has matured and it's behaviour
can be considered equivalent to the older version of GNU patch
in the tree.

The switch has been extensively tested [1] and only two ports
presented regressions, which have since been fixed.

For convenience a new WITH_GNU_PATCH option is available,
but it will likely be removed in the near future.

PR:		176313
Approved by:	portmgr
Merge ACPICA 20130725.
Add support for packet-sniffing tracers to cxgbe(4).  This works with
all T4 and T5 based cards and is useful for analyzing TSO, LRO, TOE, and
for general purpose monitoring without tapping any cxgbe or cxl ifnet
directly.

Tracers on the T4/T5 chips provide access to Ethernet frames exactly as
they were received from or transmitted on the wire.  On transmit, a
tracer will capture a frame after TSO segmentation, hw VLAN tag
insertion, hw L3 & L4 checksum insertion, etc.  It will also capture
frames generated by the TCP offload engine (TOE traffic is normally
invisible to the kernel).  On receive, a tracer will capture a frame
before hw VLAN extraction, runt filtering, other badness filtering,
before the steering/drop/L2-rewrite filters or the TOE have had a go at
it, and of course before sw LRO in the driver.

There are 4 tracers on a chip.  A tracer can trace only in one direction
(tx or rx).  For now cxgbetool will set up tracers to capture the first
128B of every transmitted or received frame on a given port.  This is a
small subset of what the hardware can do.  A pseudo ifnet with the same
name as the nexus driver (t4nex0 or t5nex0) will be created for tracing.
The data delivered to this ifnet is an additional copy made inside the
chip.  Normal delivery to cxgbe<n> or cxl<n> will be made as usual.

/* watch cxl0, which is the first port hanging off t5nex0. */
# cxgbetool t5nex0 tracer 0 tx0  (watch what cxl0 is transmitting)
# cxgbetool t5nex0 tracer 1 rx0  (watch what cxl0 is receiving)
# cxgbetool t5nex0 tracer list
# tcpdump -i t5nex0   <== all that cxl0 sees and puts on the wire

If you were doing TSO, a tcpdump on cxl0 may have shown you ~64K
"frames" with no L3/L4 checksum but this will show you the frames that
were actually transmitted.

/* all done */
# cxgbetool t5nex0 tracer 0 disable
# cxgbetool t5nex0 tracer 1 disable
# cxgbetool t5nex0 tracer list
# ifconfig t5nex0 destroy
Fix Denial of Service vulnerability in named(8). [13:07]

Security:	CVE-2013-4854
Security:	FreeBSD-SA-13:07.bind
Approved by:	so
Improve page LRU quality and simplify the logic.

 - Don't short-circuit aging tests for unmapped objects.  This biases
   against unmapped file pages and transient mappings.
 - Always honor PGA_REFERENCED.  We can now use this after soft busying
   to lazily restart the LRU.
 - Don't transition directly from active to cached bypassing the inactive
   queue.  This frees recently used data much too early.
 - Rename actcount to act_delta to be more consistent with use and meaning.

Reviewed by:	kib, alc
Sponsored by:	EMC / Isilon Storage Division
Expand the list of devices claimed by cxgbe(4).
Display a string instead of a numeric code in the linkdnrc sysctl.

Submitted by:	gnn@
Implement some function tracing.

Submitted by:	Cedric GROSS <cg@cgross.info>
Introduce 3 seconds timeout on `graid stop` command (mostly with -f flag).
Since completion waiting goes in g_event thread, it may cause GEOM deadlock
if consumer on top (for example, ZFS) uses g_event thread for closing.
- Set the System Identifier in the Primary Volume Descriptor to FreeBSD
  rather than NetBSD.
- Correctly set the Expiration Time in the Primary Volume Descriptor;
  according to ISO 9660 8.4.26.1 unspecified date and time are denoted
  by the digit 0 in RBP 1 to 16 but the number 0 in RBP 17. [1]
- Merge iso9660_rrip.c rev. 1.11 from NetBSD: name_len should be read
  as unsigned byte. [2]
  Note: This is according to ISO 9660 9.1.10.
- Rock Ridge TF entries should use a length of 5, because after the 4
  bytes of generic SUSP header there is one byte of flags. See typedef
  of ISO_RRIP_TF in iso9660_rrip.h. [1]

Submitted by:	Thomas Schmitt [1]
Obtained from:	NetBSD [2]
MFC after:	3 days
At some point after stable/7 the ACPI and ISA interfaces to the IPMI controller
no longer have the parent in the device tree.  This causes the identify
function in ipmi_isa.c to attempt to probe and poke at the ISA IPMI interface

Move the check for ipmi_attached out of the ipmi_isa_attach function and into
the ipmi_isa_identify function.  Remove the check of the device tree for
ipmi devices attached.

This probing appears to make Broadcom management firmware on Dell machines
crash and emit NMI EISA warnings at various times requiring power cycles
of the machines to restore.

Bump MAX_TIMEOUT to 6 seconds as a hack for super slow IPMI interfaces that
need longer to respond to our intial probes on startup.

Tested on Dell R410, R510, R815, HP DL160G6

This is MFC candidate for 9.2R

Reviewed by:	peter
MFC after:	2 weeks
Sponsored by:	Yahoo! Inc.
The pmap_qenter() and pmap_qremove() perform TLB invalidation on its
own, no need to call pmap_invalidate_range() one more time.

Noted by:	alc
MFC after:	1 week
MFgem r251960: re-check the mgt device object for the requested page
after the object was relocked.

Tested by:	dumbbell
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week