MFp4 @229085:

Rearrange the code so we don't call ioctl(TIOCGWINSZ) if the -s option is given,
as the result won't be used then.

Sponsored by:	The FreeBSD Foundation
MFp4 @229086:

Make use of Capsicum to protect kdump(1), as it might be used to parse data
from untrusted sources:

- Sandbox kdump(1) using capability mode.
- Limit stdin descriptor (where opened file is moved to) to only
  CAP_READ and CAP_FSTAT rights.
- Limit stdout descriptor to only CAP_WRITE, CAP_FSTAT and CAP_IOCTL.
  Plus limit allowed ioctls to TIOCGETA only, which is needed for
  isatty() to work.
- Limit stderr descriptor to only CAP_WRITE and CAP_FSTAT. In addition
  if the -s option is not given, grant CAP_IOCTL right, but allow for
  TIOCGWINSZ ioctl only, as we need screen width to dump the data.
- Before entering capability mode call catopen("libc", NL_CAT_LOCALE),
  which opens message catalogs and caches data, so that strerror(3)
  and strsignal(3) can work in a sandbox.

Sponsored by:	The FreeBSD Foundation
Discussed with:	rwatson
Temporarily revert r251058 - it breaks documented use of makeoptions
including the tinderbox.

 http://tinderbox.freebsd.org/tinderbox-head-build-HEAD-i386-i386.full
 make: don't know how to make modules-all. Stop
 make: stopped in /obj/i386.i386/src/sys/PAE
 *** Error code 2
Update comments to reflect use of svn/svnup to keep the src/ tree up
to date.

MFC after:	3 days
Avoid reading back certain registers following a write. This is an optimization.

Submitted by: David C Somayajulu
Approved by: George Neville Neil
o Change the locking scheme for swp_bcount.
  It can now be accessed with a write lock on the object containing it OR
  with a read lock on the object containing it along with the swhash_mtx.
o Remove some duplicate assertions for swap_pager_freespace() and
  swap_pager_unswapped() but keep the object locking references for
  documentation.

Sponsored by:	EMC / Isilon storage division
Reviewed by:	alc
sleep: Improve nanosleep() error handling:

 * Work around kernel bugs that cause a spurious [EINTR] return if a
   debugger (such as truss(1)) is attached.

 * Write an error message if an error other than [EINTR] occurs.

PR:		bin/178664