When pf_get_translation() fails, it should leave *sn pointer pristine,
otherwise we will panic in pf_test_rule().

PR:		182557
Partially fix IPv4 interface routes deletion in RADIX_MPATH.

Noticed by:	Nikolay Denev <ndenev at gmail.com>
MFC after:	1 month
Split the VMCS setup between 'vmcs_init()' that does initialization and
'vmx_vminit()' that does customization.

This makes it easier to turn on optional features (e.g. APICv) without
having to keep adding new parameters to 'vmcs_set_defaults()'.

Reviewed by:	grehan@
For "nvmecontrol devlist", show namespace sizes in terms of MB instead of
GB to improve granularity of the reporting - especially for namespaces
that are on the order of 1 or 2 GB.

Submitted by:	Tony Beltran <anthony.beltran@emc.com>
MFC after:	3 days
For IDENTIFY passthrough commands to Chatham prototype controllers, copy
the spoofed identify data into the user buffer rather than issuing the
command to the controller, since Chatham IDENTIFY data is always spoofed.

While here, fix a bug in the spoofed data for Chatham submission and
completion queue entry sizes.

Sponsored by:	Intel
MFC after:	3 days
Allow vlapic_set_intr_ready() to return a value that indicates whether or not
the vcpu should be kicked to process a pending interrupt. This will be useful
in the implementation of the Posted Interrupt APICv feature.

Change the return value of 'vlapic_pending_intr()' to indicate whether or not
an interrupt is available to be delivered to the vcpu depending on the value
of the PPR.

Add KTR tracepoints to debug guest IPI delivery.
Add a compile-time control over the size of KN_HASHSIZE.

This is needed for applications that use a lot of non-filedescriptor
knotes.

MFC after:	1 week
Sponsored by:	Netflix, Inc.
gperf: reverse size_type patch from r258115.

Silencing the broken warning as done in r258139 renders the
code unreacheable. An option could've been to turn off the
warnings in gperf but given that the code is not being used
it is better to just revert the original change altogether.

This code was never MFC'd.
Check the XHCI event ring regardless of the XHCI status register
value. The "Intel Lynx Point" XHCI controller found in the MBP2013 has
been observed to not always set the event interrupt bit while there
are events to consume in the event ring.

MFC after:	1 week
Tested by:	Huang Wen Hui <huanghwh@gmail.com>
Fix a rare "truncated checksums" problem, which manifested like this:

WARNING: icl_pdu_check_data_digest: data digest check failed; got 0xf23b,
    should be 0xdb7f23b

Tested by:	Darcy Birkbeck
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Fix off-by-one error in r260229.

Coverity CID:	1148955
Fix the geom mappings for WR1043ND.

The uboot mapping is only 128KiB (0x20000) and not 2MiB (0x200000).

Dynamically adjust kernel and rootfs mappings based on the
geom_uncompress(4) magic.

This makes the built images more reliable by accepting changes on kernel
size transparently and matches the images built with zrouter and
freebsd-wifi-build.

Tested by:	gjb
Approved by:	adrian (mentor)
Obtained from:	Zrouter
Use __predict_false() on sensitive lock paths as most of the times,
when PMC-soft feature is not used the check will be false.

Sponsored by:	EMC / Isilon storage division
Submitted by:	Anton Rang <anton.rang@isilon.com>
Teach every SIOCGIFSTATUS provider to fill in ifs->ascii anyway.
Remove old bits of data concat for 'ascii' field.
Remove special SIOCGIFSTATUS handling from if.c (which Coverity yells at).

Reported by:	Coverity
Coverity CID:	1147174
MFC after:	2 weeks
Fix a bug introduced in r260167 related to VM-exit tracing.

Keep a copy of the 'rip' and the 'exit_reason' and use that when calling
vmx_exit_trace(). This is because both the 'rip' and 'exit_reason' can
be changed by 'vmx_exit_process()' and can lead to very misleading traces.
Remove dead code.

Reported by:	Coverity
Coverity CID:	1018057
MFC after:	2 weeks
Remove aicasm as a build dependency.  It made sense when the ahc and ahd
drivers and their firmware were under active development, but those days
have passed.  The firmware now exists in pre-compiled form, no longer
dependent on it's sources or on aicasm.  If you wish to rebuild the
firmware from source, the glue still exists under the 'make firmware'
target in sys/modules/aic7xxx.

This also fixes the problem introduced with r257777 et al with building
kernels the old fashioned way in sys/$arch/compile/$CONFIG when the
ahc/ahd drivers were included.
MFV r260399:

Apply vendor commits:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).

Security:	CVE-2013-4353
Security:	CVE-2013-6449
Security:	CVE-2013-6450
Allow delete_method sysctl to be set to "DISABLE".
Reserve an event type for the upcoming EVENT_SENDFILE and
extend the event struct pointer union to allow for 'other' types.

Sponsored by:	Netflix, Inc.