Signed-off-by: Thibault Payet <contact@thibaultpayet.fr>
Reviewed by: imp,mhorne
Pull Request: https://github.com/freebsd/freebsd-src/pull/2001

Safe mode may be enabled because of some problem discovered with a kmod,
thus wanting to avoid devmatch.  Honor it and let the user deal with
the fallout of not autoloading modules.  We've at least made it to
userland and the user demonstrably has a local console as they selected
safe mode in the first place, so this shouldn't be fatal if we don't,
e.g., load a necessary NIC driver.

As with various other rc scripts, we don't want the output from this
being visible in the boot log.

Fixes:		6437872c1d66 ("New sysctl to disable NOMATCH until devmatch runs")
MFC after:	1 week

This gives more permissions to services (e.g. network access to
services which require this) when they are started as an automatic
service jail.

The sshd patch is important for the sshd-related functionality as
described in the man-page in the service jails part.

The location of the added env vars is supposed to allow overriding them
in rc.conf, and to hard-disable the use of svcj for some parts where it
doesn't make sense or will not work.

Only a subset of all of the services are fully tested (I'm running this
since more than a year with various services started as service jails).
The untested parts should be most of the time ok, in some edge-cases
more permissions are needed inside the service jail.
Differential Revision:	https://reviews.freebsd.org/D40371

Introduce hw.bus.devctl_nomatch_enabled and use it to suppress NOMATCH
until devmatch runs

There's a lot of NOMATCH events generated at boot. We also run devmatch
once during early boot to load unmatched devices. To avoid redundant
work, don't start generating NOMATCH events until after devmatch runs.
Set hw.bus.devctl_nomatch_enabled=1 just before we run devmatch. The
kernel will suppress NOMATCH events until this is set to true.

This saves about 170ms from the boot on aarch64 running atop Apple
M-series processors and the VMWare Fusion hypervisor.

Reviewed by:    imp, cperciva
MFC after:      3 days
Sponsored by:   Google Summer of Code
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1213

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Add in all the variables set in the kenv variable devmatch_blocklist
too. This allows blocking autoloading from the boot loader.

Sponsored by:		Netflix
Reviewed by:		0mp
Differential Revision:	https://reviews.freebsd.org/D32171

devmatch rc script would announce it was loading a module multiple
times. It used kldload -n so it really wasn't loading it that many
times, but the message is confusing. Use kldstat to see if we need to
load the module before saying we do. This fixes the vast majority of the
problems. It may be possible to race devmatch with a user invocation and
devd, though quite hard. In that case we'll announce things twice, but
still only load it once. No attempt is made to fix this.

PR:			232782
MFC After:		2 weeks
Sponsored by:		Netflix

We document that we did not need .ko on the module names in
devmatch_blocklist, but we really needed them. Keep the documentation
the same, but strip the .ko when we need to use the names so you can
specify either.

PR:			256240
MFC After:		2 weeks
Sponsored by:		Netflix

devmatch loads a number of things automatically. Allow the list of
things to load to happen first in case those drivers affect what would
be loaded. Normally, this will produce the same results, but there's
some special cases that may not when drivers are loaded that report
other drivers missing, like virtio_pci.

PR:		253287
Reviewed by:	imp
MFC After:	2 weeks