The pass(4) driver's CAMIOCOMMAND and CAMIOQUEUE ioctls accept arbitrary
CCBs from userland.  This device requires root to open, and thus send
these commands. Previously, the only func_code filter was a blocklist
check against the XPT_FC_XPT_ONLY flag.  This missed several dangerous
func_codes that lack that flag:

 - XPT_ABORT: the abort_ccb field is a raw kernel pointer from the
   user CCB payload.  xpt_action_default() dereferences it without
   validation, leading to kernel crashes or worse.

 - XPT_SASYNC_CB: the callback and callback_arg fields come directly
   from the user CCB payload and get registered as a kernel async
   callback, allowing arbitrary kernel code execution.

 - Target mode CCBs (XPT_EN_LUN, XPT_TARGET_IO, etc.) fall through
   directly to the SIM with user-controlled payloads.

Replace the XPT_FC_XPT_ONLY blocklist with an explicit allowlist of CCB
function codes that are known to be safe for userland to submit: I/O
operations (SCSI, ATA, NVMe, SMP, MMC), device queries, transport
settings, and a handful of safe control operations (NOOP, REL_SIMQ,
RESET_DEV, DEBUG). Normally, the /dev/pass* permissions only allow root
to access them, so this is only a safety issue by default.

Also reject CAM_DATA_PADDR and CAM_DATA_SG_PADDR, since these pass
user-supplied physical addresses directly to DMA with no validation,
which on systems without an IOMMU allows arbitrary host memory access.
Add `options PASS_UNSAFE_PADDR` to allow the old behavior.

Verified that camdd, camcontrol, smartmontools, and cdrtools use only
func_codes on the allowlist (XPT_SCSI_IO, XPT_ATA_IO, XPT_NVME_IO,
XPT_NVME_ADMIN, XPT_PATH_INQ, XPT_GDEV_TYPE, XPT_GET_TRAN_SETTINGS,
XPT_SET_TRAN_SETTINGS, XPT_RESET_DEV, XPT_DEBUG) and none use
CAM_DATA_PADDR.

PR:			293888, 293890
Assisted-By:		Claude Opus 4.6 (1M context)
Sponsored by:		Netflix
Reviewed by:		jhb
Differential Revision:	https://reviews.freebsd.org/D56486

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

One src per line + sorting.

Sponsored by:		Netflix

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Now that machdep files are gone, we don't need $S/$M/$M in the path to find
them.

reasons. Those have now left the tree, and with them the need to have machdep
files. Places that called the routines in quesiton have been removed
previously. Remove these files from the Makefile to tidy up.

cam.ko can't load onto the kernel w/o nvme in the kernel. Add
nvme_util.c to cam.ko.

Noticed by: kib@

opt_compat.h is mentioned in nearly 180 files. In-progress network
driver compabibility improvements may add over 100 more so this is
closer to "just about everywhere" than "only some files" per the
guidance in sys/conf/options.

Keep COMPAT_LINUX32 in opt_compat.h as it is confined to a subset of
sys/compat/linux/*.c.  A fake _COMPAT_LINUX option ensure opt_compat.h
is created on all architectures.

Move COMPAT_LINUXKPI to opt_dontuse.h as it is only used to control the
set of compiled files.

Reviewed by:	kib, cem, jhb, jtl
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14941

Now that it can co-exist in the kernel with nvd, add it back to the
cam module.

Sponsored by: Netflix

Noticed by: hps@