do not use capsicum when building picobsd images
Fix NULL dereference panic on UDP requests introduced in r260229.
It is 2014 and we have a new version of netmap.
Most relevant features:

- netmap emulation on any NIC, even those without native netmap support.

  On the ixgbe we have measured about 4Mpps/core/queue in this mode,
  which is still a lot more than with sockets/bpf.

- seamless interconnection of VALE switch, NICs and host stack.

  If you disable accelerations on your NIC (say em0)

        ifconfig em0 -txcsum -txcsum

  you can use the VALE switch to connect the NIC and the host stack:

        vale-ctl -h valeXX:em0

  allowing sharing the NIC with other netmap clients.

- THE USER API HAS SLIGHTLY CHANGED (head/cur/tail pointers
  instead of pointers/count as before). This was unavoidable to support,
  in the future, multiple threads operating on the same rings.
  Netmap clients require very small source code changes to compile again.
      On the plus side, the new API should be easier to understand
  and the internals are a lot simpler.

The manual page has been updated extensively to reflect the current
features and give some examples.

This is the result of work of several people including Giuseppe Lettieri,
Vincenzo Maffione, Michio Honda and myself, and has been financially
supported by EU projects CHANGE and OPENLAB, from NetApp University
Research Fund, NEC, and of course the Universita` di Pisa.
Apply band-aid for 32-bit compat libs failures after r260334: put back
-Qunused-arguments for clang for now, until I can figure out a way to
make it unneeded in all scenarios.  Sorry about the breakage.
Switch to using arm_devmap_add_entry() to set up static device mapping.
This eliminates the hard-coded max kva and roughly doubles the available
kva space.
Allow 'no static device mappings' to potentially work.  It's not clear that
every arm system must have some static mappings to work correctly (although
currently they all do), so remove some panic() calls (which would never
been seen anyway, because they would happen before a console is available).
Don't try to find a static mapping before calling pmap_mapdev(), that logic
is now part of pmap_mapdev() and doesn't need to be duplicated here.
Likewise for unmapping.
Switch to using arm_devmap_add_entry() to set up static device mapping.
This eliminates the hard-coded max kva and roughly doubles the available
kva space.
Fix arm build.

Reviewed by:	ian, zbb
Correct a grammo in a comment; remove white space at EOL.
When pf_get_translation() fails, it should leave *sn pointer pristine,
otherwise we will panic in pf_test_rule().

PR:		182557
Partially fix IPv4 interface routes deletion in RADIX_MPATH.

Noticed by:	Nikolay Denev <ndenev at gmail.com>
MFC after:	1 month
Split the VMCS setup between 'vmcs_init()' that does initialization and
'vmx_vminit()' that does customization.

This makes it easier to turn on optional features (e.g. APICv) without
having to keep adding new parameters to 'vmcs_set_defaults()'.

Reviewed by:	grehan@
For "nvmecontrol devlist", show namespace sizes in terms of MB instead of
GB to improve granularity of the reporting - especially for namespaces
that are on the order of 1 or 2 GB.

Submitted by:	Tony Beltran <anthony.beltran@emc.com>
MFC after:	3 days
For IDENTIFY passthrough commands to Chatham prototype controllers, copy
the spoofed identify data into the user buffer rather than issuing the
command to the controller, since Chatham IDENTIFY data is always spoofed.

While here, fix a bug in the spoofed data for Chatham submission and
completion queue entry sizes.

Sponsored by:	Intel
MFC after:	3 days
Allow vlapic_set_intr_ready() to return a value that indicates whether or not
the vcpu should be kicked to process a pending interrupt. This will be useful
in the implementation of the Posted Interrupt APICv feature.

Change the return value of 'vlapic_pending_intr()' to indicate whether or not
an interrupt is available to be delivered to the vcpu depending on the value
of the PPR.

Add KTR tracepoints to debug guest IPI delivery.
Add a compile-time control over the size of KN_HASHSIZE.

This is needed for applications that use a lot of non-filedescriptor
knotes.

MFC after:	1 week
Sponsored by:	Netflix, Inc.
gperf: reverse size_type patch from r258115.

Silencing the broken warning as done in r258139 renders the
code unreacheable. An option could've been to turn off the
warnings in gperf but given that the code is not being used
it is better to just revert the original change altogether.

This code was never MFC'd.
[automated] Merge in upstream-github/master