Pull up following revision(s) (requested by maxv in ticket #1048):
	sys/kern/kern_exec.c: revision 1.403
'error' is not set on failure. This is a true bug: everything is freed
and unlocked while zero is returned. Since there's no error, execve_runproc()
will get called and will try to use those freed things.
Pull up following revision(s) (requested by abs in ticket #1049):
	distrib/sets/lists/base/rescue.ad.m68k.shl: revision 1.3
	distrib/sets/lists/base/rescue.sparc: revision 1.4
	distrib/sets/lists/base/rescue.shark: revision 1.3
	distrib/sets/lists/base/rescue.vax: revision 1.3
	distrib/sets/lists/base/rescue.i386: revision 1.4
Mark /rescue/ldconfig as 'pic' only to enable building static releases (NOPIC=).
Only MKX11=no tested.
Pull up following revision(s) (requested by maxv in ticket #1050):
	sys/ufs/chfs/chfs_vfsops.c: revision 1.11
	sys/fs/unionfs/unionfs_vfsops.c: revision 1.13
	sys/fs/nilfs/nilfs_vfsops.c: revision 1.16
	sys/ufs/mfs/mfs_vfsops.c: revision 1.107
	sys/fs/sysvbfs/sysvbfs_vfsops.c: revision 1.43
	sys/ufs/ffs/ffs_vfsops.c: revision 1.297
	sys/kern/vfs_syscalls.c: revision 1.478
	sys/kern/vfs_syscalls.c: revision 1.479
	sys/fs/puffs/puffs_vfsops.c: revision 1.110
	sys/fs/cd9660/cd9660_vfsops.c: revision 1.84
	sys/nfs/nfs_vfsops.c: revision 1.227
	sys/fs/v7fs/v7fs_vfsops.c: revision 1.10
	sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.180
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.92
	sys/fs/filecorefs/filecore_vfsops.c: revision 1.76
	sys/miscfs/nullfs/null_vfsops.c: revision 1.88
	sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.50
	sys/coda/coda_vfsops.c: revision 1.81
	sys/ufs/lfs/lfs_vfsops.c: revision 1.321
	sys/fs/tmpfs/tmpfs_vfsops.c: revision 1.59
	sys/fs/hfs/hfs_vfsops.c: revision 1.31
	sys/miscfs/overlay/overlay_vfsops.c: revision 1.61
	sys/fs/union/union_vfsops.c: revision 1.72
	sys/fs/ntfs/ntfs_vfsops.c: revision 1.94
	sys/kern/vfs_syscalls.c: revision 1.480
	sys/fs/efs/efs_vfsops.c: revision 1.25
	sys/kern/vfs_syscalls.c: revision 1.482
	sys/fs/msdosfs/msdosfs_vfsops.c: revision 1.107
	external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c: revision 1.12
	sys/miscfs/procfs/procfs_vfsops.c: revision 1.91
	sys/fs/smbfs/smbfs_vfsops.c: revision 1.100
	sys/fs/adosfs/advfsops.c: revision 1.70
	sys/fs/udf/udf_vfsops.c: revision 1.67
Limit check for 'data_len'. Otherwise a (un)privileged user can easily
panic the system by passing a huge size.
ok christos@
An (un)privileged user can easily make the kernel dereference a NULL
pointer.
The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).
ok christos@
Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check
to prevent an (un)privileged user from requesting a zero-sized allocation
(and thus a panic).
This thing is totally buggy: 'data_len' is modified by the fs, so calling
kmem_free with it while its value has changed since the kmem_alloc is far
from being a good idea.
If the kernel figures out that something mismatches, it will panic
(typically with kernfs).
tickets 1048, 1049, 1050
Pull up following revision(s) (requested by maxv in ticket #1051):
	sys/compat/linux/common/linux_exec_elf32.c: revision 1.91 via patch
A specially-crafted binary could easily control a kernel array index.
Add some checks to ensure that nothing will be read outside the allocated
area. Rewrite the code so that we don't need to allocate the whole section.
Spotted by several developers, patch from chs@/enami@
ticket 1051
Pull up following revision(s) (requested by christos in ticket #1036):
	lib/libc/net/sethostent.c: revision 1.20
fix memory leak
XXX: pullup 6
Ticket 1036.
Add missing newlines.
Ticket 1063.
Pull up following revision(s) (requested by mrg in ticket #1052):
	usr.sbin/postinstall/postinstall: revision 1.166
don't apply "ptyfsoldnodes" if /dev/pts does not exist, even if ptyfs
is listed in /etc/fstab.  without this, postinstall happily removes
all your ptys leaving you with none at all.  return an error if we
have ptyfs in /etc/fstab, but no /dev/pts.
Pull up following revision(s) (requested by abs in ticket #1053):
	distrib/sets/lists/man/mi: revision 1.1472
Fix MKPAM=no build
Pull up following revision(s) (requested by abs in ticket #1054):
	sys/kern/subr_pool.c: revision 1.202
Ensure pool_head is non static - for "vmstat -i"
Pull up following revision(s) (requested by skrll in ticket #1055):
	sys/arch/mips/mips/bus_dma.c: revision 1.28
When decide to coalesce segments, if the d_cache isn't coherent also make
sure the VA is contiguous as well.
Pull up following revision(s) (requested by skrll in ticket #1056):
	sys/arch/mips/mips/pmap.c: revision 1.211
	sys/arch/mips/mips/pmap.c: revision 1.212
	sys/arch/mips/mips/pmap.c: revision 1.213
	sys/arch/mips/mips/vm_machdep.c: revision 1.143
	sys/arch/mips/mips/pmap.c: revision 1.210
Fix a logic inversion introduced with the matt-nb5-mips64 for
pmap_{zero,copy}_page cache alias handing. The check previously used
PG_MD_UNCACHED_P, where it now uses PG_MD_CACHED_P, when considering if
a cache invalidation is required.
Additionally flush the cache for the uarea va to avoid potential (future)
cache aliases in cpu_uarea_free when handing pages back to uvm for later
use.
ok matt@
Hopefully this addresses the instability reported in the following PRs:
PR/44900 - R5000/Rm5200 mips ports are broken
PR/46170 - NetBSD/cobalt 6.0_BETA does not boot
PR/46890 - upcoming NetBSD 6.0 release is very unstable / unusable on cobalt qube 2
PR/48628 - cobalt and hpcmips ports are dead
Grab pv_list lock in pmap_unmap_ephemeral_page only when needed.
Make PARANOIADIAG compile.
Use pmap_tlb_asid_check to reduce code c&p.
Pull up following revision(s) (requested by tsutsui in ticket #1057):
	sys/arch/hp300/conf/RAMDISK: revision 1.14
	sys/arch/hp300/conf/INSTALL: revision 1.57
Add "pseudo-device wsmux" in INSTALL (and RAMDISK) kernels.
On NetBSD/hp300, hilkbd(4) is probed in config_interrupts(9)
so it's always attached after wsdisplay(4).  In that case,
wskbd can't be used as a console input device without wsmux(4).
(i.e. keyboard didn't work on installer using screen console)
Should be pulled up to all netbsd-6* branches.
Disable options NVNODE, NBUF and BUFPAGES in the RAMDISK kernel.
These options were specified in the INSTALL kernel for 4MB machines,
but nowadays even the INSTALL kernel would not boot on such machines
and the RAMDISK kernel assumes the target machine has more memories.
Furthermore, these options makes extracting binary sets much slower
and also could cause "wapbl_register_deallocation: out of resources"
panic during extracting binaries into a 32GB SSD with 4KB fragments.
Should be pulled up to netbsd-6* branches.
Pull up following revision(s) (requested by tsutsui in ticket #1058):
	sys/arch/hp300/conf/files.hp300: revision 1.88
	sys/arch/hp300/include/autoconf.h: revision 1.13
	sys/dev/ic/sti.c: revision 1.17
	sys/arch/hp300/dev/frodo.c: revision 1.31
	sys/arch/hp300/conf/GENERIC: revision 1.173
	sys/arch/hp300/hp300/machdep.c: revision 1.229
	sys/arch/hp300/dev/frodo.c: revision 1.32
	sys/arch/hp300/hp300/autoconf.c: revision 1.102
	sys/arch/hp300/dev/frodoreg.h: revision 1.5
	sys/arch/hp300/stand/common/ite_sti.c: revision 1.1
	sys/arch/hp300/stand/common/itevar.h: revision 1.16
	sys/arch/hp300/hp300/autoconf.c: revision 1.105
	sys/arch/hp300/dev/sti_sgcvar.h: revision 1.1
	sys/arch/hp300/stand/common/apci.c: revision 1.12
	sys/arch/hp300/stand/common/apci.c: revision 1.13
	sys/arch/hp300/dev/dnkbd.c: revision 1.6
	sys/arch/hp300/dev/dnkbd.c: revision 1.7
	sys/arch/hp300/stand/inst/version: revision 1.12
	sys/arch/hp300/dev/com_frodo.c: revision 1.9
	sys/arch/hp300/stand/common/ite.c: revision 1.17
	sys/arch/hp300/conf/GENERIC: revision 1.181
	sys/arch/hp300/dev/sti_sgc.c: revision 1.1
	sys/arch/hp300/stand/common/dnkbd.c: revision 1.13
	sys/arch/hp300/dev/sti_sgc.c: revision 1.2
	sys/dev/ic/stivar.h: revision 1.8
	sys/arch/hp300/dev/rtc.c: revision 1.21
	sys/arch/hp300/conf/INSTALL: revision 1.56
	sys/arch/hp300/conf/INSTALL: revision 1.58
	sys/arch/hp300/stand/uboot/version: revision 1.19
	sys/arch/hp300/stand/common/samachdep.h: revision 1.17
	sys/arch/hp300/stand/common/clock.c: revision 1.12
	sys/arch/hp300/dev/mcclock_frodo.c: revision 1.1
	sys/arch/hp300/stand/Makefile.buildboot: revision 1.34
	sys/arch/hp300/conf/files.hp300: revision 1.87
Add sti at sgc framebuffer.
Ported from OpenBSD by kiyohara@.
Fix a botch on switching from apci (and dca) to MI com(4) 10 years ago.
I.e. fix apci device address per FRODO_BASE macro change
in frodoreg.h rev 1.2.  Now bootloader works with serial console
on HP425e (which has only com at frodo).
Thanks to miod@openbsd for providing his 425e.
Add sti(4) at sgc screen console support.  From (the late) OpenBSD/hp300.
Tested on HP9000/425e, which was sent from Miod Vallat and
demonstrated at Open Source unConference 2014 Kagawa.
Check the service switch on 425e to select apci serial console.
Taken from OpenBSD/hp300.  See the following comment for details:
> * Check the service switch. On the 425e, this is a physical
> * switch, unlike other frodo-based machines, so we can use it
> * as a serial vs internal video selector, since the PROM can not
> * be configured for serial console.
Add proper RealTime Clock support for HP9000/425e.
As the OpenBSD/hp300 page says 425e doesn't have the traditional
RTC at intio (as it also lacks DCA 16550 serial at intio?),
but after a few hour investigation it turns out that
425e uses mc146818 compatible calendar clock in
the Apollo "frodo" utility chip and the frodo chip on
425e actually has the 32kHz OSC and is actually backed up
by the onboard lithium battery.
Tested on HP425e (with mcclock) and HP362 (with old rtc).
Add RTC support for HP9000/425e to bootloader too.
Also put several cleanup:
- make local functions and variables static
- use proper variable types
- some KNF
Note it turns out that extreme slowness of netboot on hp300 is
caused by the too slow access of the traditional RTC chip at intio
(i.e. netboot on 425e is so much faster than others). Oh well.
Add proper consinit(9) support for sti(4) at sgc framebuffer on hp300.
The cnattach functions for sti(4) and service switch check method
for 425e in com_frodo.c are taken from OpenBSD.
The strategy how to choose the console device in hp300_cninit() is
quite diverged from 4.4BSD and OpenBSD so it's tweaked by me.
Also put several changes in sti_sgc.c to reduce diffs from OpenBSD/hp300.
Tested on 425e and 362 (which still uses gendiofb(4), not sti(4)).
XXX: sti(4) requires uvm_km_alloc(9) and uvm_map_protect(9)
     to copy and call ROM functions on the executable memory region, so
     it can be called before UVM and related initializations are complete.
     Probably it's time to consider about MI "deferred consinit()" API
     in init_main.c (or elsewhere) for modern complicated VM system...
Also fix the apci device address in dnkbd.c as apci.c rev 1.12:
http://mail-index.netbsd.org/source-changes/2014/04/10/msg053940.html
Finally dnkbd(4) is confirmed working at least on bootloader.
Thanks again to Miod Vallat.
Make the Apollo Domain keyboard actually work.
Tested on HP9000/425e and the keyboard model A1630-82001 R2 (RX-60857-HW)
provided by Miod Vallat.  Mouse support needs more work.
Pull random notes on the Apollo Domain keyboard from ancient PR/3528.
Bump versions to denote recent 425e related changes.
Probe mcclock only on 425e to avoid an extra "not configured" message.
Add and enable sti(4) at sgc in install kernels for 425e.
Tested on both serial console and framebuffer console.
(switched by the service switch on the back panel)
Pull up following revision(s) (requested by joerg in ticket #1059):
	usr.bin/nbperf/nbperf-bdz.c: revision 1.9 via patch
Most CPUs implement shifts modulo the width, but ARM doesn't. Don't
depend on this UB.
Pull up following revision(s) (requested by sborrill in ticket #1060):
	sys/arch/x86/pci/pci_machdep.c: revision 1.66
Force pci_mode 1 when running as Xen HVM domU to allow cd* to be
detected correctly. Fixes kern/48770. Thanks to cube@
Pull up following revision(s) (requested by christos in ticket #1061):
	sys/kern/kern_exit.c: revision 1.244
Free pid for linux processes. Reported by Mark Davies, fix by dsl@
XXX: pullup 6