Phase 1 of migration of the per-jail hardening feature toggles to their own struct

Conflicts:
	sys/kern/kern_pax.c
	sys/kern/kern_pax_hardening.c
	sys/sys/jail.h
Fix build breakage
Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/master
sh: Make getopts memory-safe if with changing arguments.

POSIX does not permit to continuing a getopts loop with different
arguments. For parsing the positional parameters, we handle this case by
resetting the getopts state when the positional parameters are changed in
any way (and the getopts state is local to a function). However, in the
syntax getopts <optstring> <var> <arg...>, changes could lead to invalid
memory access.

In the syntax getopts <optstring> <var> <arg...>, store a copy of the
arguments and continue to use them until getopts is reset.
By the time that pmap_init() runs, vm_phys_segs[] has been initialized.  Obtaining
the end of memory address from vm_phys_segs[] is a little easier than obtaining it
from phys_avail[].

Discussed with:	Svatopluk Kraus
Remove incorrect semicolon.
Remove the ARM_DEVICE_MULTIPASS option and make its effect be the default.

Multipass device attachment was tested on many arm platforms by users and
only success was reported on the arm@ mailing list.  This is just the
long-delayed followup of making it the default.

Multipass attachment is necessary when using vendor-supplied FDT data,
because our devices may need to be attached in a different order than they
are described in the FDT data.
Fix CF ERASE breakage caused by 268205.

This prevents BIO_DELETE requests getting stuck in the TRIM queue which
results in a panic on shutdown due to outstanding requests.

PR:		194606
Reported by:	Guido Falsi
Reviewed by:	mav
MFC after:	3 days
Sponsored by:	Multiplay
Change the type of the first argument to the I/O emulation handlers to
'struct vm *'. Previously it used to be a 'void *' but there is no reason
to hide the actual type from the handler.

Discussed with:	tychon
MFC after:	1 week
Avoid dynamic syscall overhead for statically compiled modules.

The kernel tracks syscall users so that modules can safely unregister them.

But if the module is not unloadable or was compiled into the kernel, there is
no need to do this.

Achieve this by adding SY_THR_STATIC_KLD macro which expands to SY_THR_STATIC
during kernel build and 0 otherwise.

Reviewed by:	kib (previous version)
MFC after:	2 weeks
Fix support for LUN flat space addressing.

MFC after:	1 week
Replace update from -r271410 accidentally lost in -r273575.
Add a comment explaining the intent behind the I/O reservation [0x72-0x77].
Merge remote-tracking branch 'freebsd/master' into hardened/current/master
Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/segvguard