Add a resource limit for the total number of kqueues available to the
user.  Kqueue now saves the ucred of the allocating thread, to
correctly decrement the counter on close.

Under some specific and not real-world use scenario for kqueue, it is
possible for the kqueues to consume memory proportional to the square
of the number of the filedescriptors available to the process.  Limit
allows administrator to prevent the abuse.

This is kernel-mode side of the change, with the user-mode enabling
commit following.

Reported and tested by:	pho
Discussed with:	jmg
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
Add a resource limit for the total number of kqueues available to the
user.  Kqueue now saves the ucred of the allocating thread, to
correctly decrement the counter on close.

Under some specific and not real-world use scenario for kqueue, it is
possible for the kqueues to consume memory proportional to the square
of the number of the filedescriptors available to the process.  Limit
allows administrator to prevent the abuse.

This is kernel-mode side of the change, with the user-mode enabling
commit following.

Reported and tested by:	pho
Discussed with:	jmg
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
Use standard ofw_bus helpers instead of reinventing the wheel.
Don't force 64-bit DWARF2 on MIPS

64-bit debug data is only necessary for objects with greater than 4GB of
debug data, and is not used on other 64-bit FreeBSD targets.

Sponsored by:	DARPA, AFRL
Allow kernels without options SOFTUPDATES to build.  This should fix the
embedded tinderboxes.

Reviewed by:	emaste
MFP4: 223121 (FDT infrastructure portion)

Implement support for interrupt-parent nodes in simplebus.  The current
implementation requires that device declarations have an interrupt-parent
node and that it point to a device that has registered itself as a
interrupt controller in fdt_ic_list_head and implements the fdt_ic
interface.

Sponsored by:   DARPA/AFRL
Add comments that taskqueue_enqueue_locked() returns without the lock.
Make hard-wired TLB allocations be at minimum one page. This is required by
some implementations, most notably (in my case) QEMU's e500 emulation.
Remove the isf(4) driver.  It was created by accident and is subset of
the cfi(4) driver.  It remained in the tree longer than would be ideal
due to the time required to bring cfi(4) to feature parity.

Sponsored by:	DARPA/AFRL
MFC after:	3 days
Resolve clang warning about a use of syslog. By using a proper enforcement
of string format in a call so syslog

/usr/src/gnu/lib/libssp/../../../contrib/gcclibs/libssp/ssp.c:137:23:
warning: format string is not a string literal (potentially insecure)
      [-Wformat-security]
    syslog (LOG_CRIT, msg1);
                      ^~~~

Reviewed by:	dim@
Make netback compile without INET support in the kernel.

This shuld have been a problem since r230587.  Not exactly sure why it
was not detected the last weeks with the tinderbox.  I would assume
r255744 is what started to cause it.

MFC after:	1 week
Return standards-compliant code from OF_nextprop() with FDT when no
properties remain on this node.
- Implement watchdog function and register it with watchdog list
Make watchdog function conform watchdog(9):
Set error to 0 when watchdog is armed and disable it when timeout
is too large to be set.
Start rtsold if necessary.

Reviewed by:	hrs
MFC after:	3 days
Add a reload command.

Reviewed by:	hrs
MFC after:	3 days
Merge GEOM direct dispatch changes from the projects/camlock branch.

When safety requirements are met, it allows to avoid passing I/O requests
to GEOM g_up/g_down thread, executing them directly in the caller context.
That allows to avoid CPU bottlenecks in g_up/g_down threads, plus avoid
several context switches per I/O.

The defined now safety requirements are:
 - caller should not hold any locks and should be reenterable;
 - callee should not depend on GEOM dual-threaded concurency semantics;
 - on the way down, if request is unmapped while callee doesn't support it,
   the context should be sleepable;
 - kernel thread stack usage should be below 50%.

To keep compatibility with GEOM classes not meeting above requirements
new provider and consumer flags added:
 - G_CF_DIRECT_SEND -- consumer code meets caller requirements (request);
 - G_CF_DIRECT_RECEIVE -- consumer code meets callee requirements (done);
 - G_PF_DIRECT_SEND -- provider code meets caller requirements (done);
 - G_PF_DIRECT_RECEIVE -- provider code meets callee requirements (request).
Capable GEOM class can set them, allowing direct dispatch in cases where
it is safe.  If any of requirements are not met, request is queued to
g_up or g_down thread same as before.

Such GEOM classes were reviewed and updated to support direct dispatch:
CONCAT, DEV, DISK, GATE, MD, MIRROR, MULTIPATH, NOP, PART, RAID, STRIPE,
VFS, ZERO, ZFS::VDEV, ZFS::ZVOL, all classes based on g_slice KPI (LABEL,
MAP, FLASHMAP, etc).

To declare direct completion capability disk(9) KPI got new flag equivalent
to G_PF_DIRECT_SEND -- DISKFLAG_DIRECT_COMPLETION.  da(4) and ada(4) disk
drivers got it set now thanks to earlier CAM locking work.

This change more then twice increases peak block storage performance on
systems with manu CPUs, together with earlier CAM locking changes reaching
more then 1 million IOPS (512 byte raw reads from 16 SATA SSDs on 4 HBAs to
256 user-level threads).

Sponsored by:	iXsystems, Inc.
MFC after:	2 months
Remove Giant-locked drivers support (DISKFLAG_NEEDSGIANT flag) from disk(9).

Since at least FreeBSD 7 we had only four of them in the base tree, and
in head branch, thanks to jhb@, we have no any for more then a year.
Remove global device lock acquisition from dev_relthread(), replacing it
with atomics on per-device data.
Update ahci(4), respecting recent driver changes.