Fix callout expiring dynamic rules.

PR:		kern/175530
Submitted by:	Vladimir Spiridenkov <vs@gtn.ru>
MFC after:	2 weeks
Garbage collect HPFS bits which are now already completely disconnected
from the tree since few months (please note that the userland bits
were already disconnected since a long time, thus there is no need
to update the OLD* entries).

This is not targeted for MFC.
Garbage collect XFS bits which are now already completely disconnected
from the tree since few months.

This is not targeted for MFC.
- Complete r231621 by also blacklisting the bridge used by VMware for PCIe
  devices. While at it, update the comment now that we know that MSI-X
  doesn't work with ESXi 5.1 for Intel 82576 either and the underlying issue
  is a bug in the MSI-X allocation code of the hypervisor.
  Reported by: Harald Schmalzbauer
- Make the nomatch table const.

MFC after:	1 week
Garbage collect CODAFS bits which are now completely disconnected from
the tree since few months.

This patch is not targeted for MFC.
Garbage collect PORTALFS bits which are now completely disconnected from
the tree since few months.

This patch is not targeted for MFC.
The value held by the vm object's field pg_color is only considered
valid if the flag OBJ_COLORED is set.  Since _vm_object_allocate()
doesn't set this flag, it needn't initialize pg_color.

Sponsored by:	EMC / Isilon Storage Division
Comment cosmetics: capitalize SCSI
Fix some hard tabs in the wrong place.

MFC after:	2 weeks
Remove ntfs headers dependency for g_label_ntfs.c by redefining the
used structs and values.

This patch is not targeted for MFC.
Garbage collect NTFS bits which are now completely disconnected from
the tree since few months.

This patch is not targeted for MFC.
Fix ipfw table argument parsing/printing.
Fix style.

PR:		kern/175909
Submitted by:	Daniel Hagerty <hag@linnaean.org>
MFC after:	2 weeks
- Implement two new system calls:

	int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
	int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);

  which allow to bind and connect respectively to a UNIX domain socket with a
  path relative to the directory associated with the given file descriptor 'fd'.

- Add manual pages for the new syscalls.

- Make the new syscalls available for processes in capability mode sandbox.

- Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on
  the directory descriptor for the syscalls to work.

- Update audit(4) to support those two new syscalls and to handle path
  in sockaddr_un structure relative to the given directory descriptor.

- Update procstat(1) to recognize the new capability rights.

- Document the new capability rights in cap_rights_limit(2).

Sponsored by:	The FreeBSD Foundation
Discussed with:	rwatson, jilles, kib, des
Regen after r247667.
Add support for bindat(2) and connectat(2).

Sponsored by:	The FreeBSD Foundation
MFcalloutng:
Give OFED Linux wrapper own "expires" field instead of abusing callout's
c_time, which will change its type and units with calloutng commit.
Polish few spaces/tabs.
Add protective parentheses for macro argument, missed in r247671.
If all ioctls are allowed, cap_ioctls_get(2) will return CAP_IOCTLS_ALL.
Update regression tests.
Fix-up r247622 by also renaming pv_list iterator into the xen
pmap verbatim copy.

Sponsored by:	EMC / Isilon storage division
Reported by:	tinderbox
libedit does not need to be linked with ncurses

libedit uses the terminfo headers but doesn't really need
to be linked with ncurses.

Discussed with:		christos@NetBSD
MFC after;		3 days