MFC r263912:
Clear the kernel grab of the FPU state on fork.
MFC r262755: sh: Make argstr() return where it stopped and simplify expari()
using this.
MFC r263195: sh: Add some consts.
MFC r263244: find: When performing -quit, finish pending -exec ... + command
lines.

This avoids unexpected partial processing when a find command uses both
-quit and -exec ... +.

GNU find does the same.
waitid(2): Do not tell userland programmers to include <sys/signal.h>.

Userland should get these definitions by including <signal.h>.
MFC r258794: chmod(2): Document S_ISVTX following SUSv3/SUSv4.

S_ISTXT is non-standard.

While here, also update fchmodat() standards entry to POSIX.1-2008.
MFC r262872: fts: Don't abort if an empty pathname is given.

Make fts_open(3) treat an empty pathname like any other pathname that cannot
be lstatted because of [ENOENT].

It is rather confusing if  rm -rf file1 "" file2  does not remove file1 and
file2.

PR:		bin/187264
login: Clean up PAM and audit, then exit, on SIGHUP and SIGTERM.

This avoids leaving stale entries in utmpx after the connection is closed on
an open login session. It also allows a clean way (SIGTERM) to forcibly
terminate a user's terminal session.

This does not affect the situation for "hung" processes after the connection
is closed. The foreground process group receives SIGHUP and the tty becomes
inaccessible.

Also replace all use of the obsolete signal() function with sigaction() (not
only the part where it is actually required: SIGHUP and SIGTERM must mask
the other as well when caught).

PR:		misc/183495
MFC	r263973;

ddb: Minor style cleanups.

#define should be followed by tab.
MFC	r264121;
gcc: define __block when block support is enabled

This mimics the behaviour in clang and lets us build cleanly
the libdispatch port on platforms where the base gcc is still
the default compiler.

Bump __FreeBSD_version for ports.

Tested by:	theraven
MFC r263966:
  Don't copy the MF flag from original IP header to ICMP error message.

PR:		188092
Sponsored by:	Yandex LLC
MFC r263969,263971:
  Don't generate an ICMPv6 error message if packet was consumed by filter.
  Remove unused label.

Sponsored by:	Yandex LLC
MFC r264027, r264028, r264029, r264030, r264046, r264073:

r264027:
  Add a new release build variable, WITH_COMPRESSED_IMAGES.

  When set to a non-empty value, the installation medium is
  compressed as part of the 'install' target in the release/
  directory.

r264028:
  Clean up trailing whitespace in release/Makefile.

r264029:
  Fix logic error.

r264030:
  If WITH_COMPRESSED_IMAGES is set, add the compressed images
  to the CLEANFILES list.

r264046:
  Use xz(1) instead of gzip(1) to compress release images
  when WITH_COMPRESSED_IMAGES is used.

r264073:
  Allow overriding xz(1) path.

Sponsored by:	The FreeBSD Foundation
Fix NFS deadlock vulnerability. [SA-14:05]

Fix "Heartbleed" vulnerability and ECDSA Cache Side-channel
Attack in OpenSSL. [SA-14:06]
MFC 259635:
Add an option to ignore accesses by the guest to unimplemented MSRs.

Also, ignore a couple of SandyBridge uncore PMC MSRs that Centos 6.4 writes
to during boot.
Document SA-14:05.nfsserver, SA-14:06.openssl.

Sponsored by:	The FreeBSD Foundation
Bump osreldate for tracking SA-14:06
Remove useless embedding of kernel struct rtentry into userland one.
This is direct commit to stable/10.

Sponsored by:	Nginx, Inc.
Merge r263203: garbage collect long time obsoleted (or never used) stuff
from routing API.
MFC r264039:
  Document more parition types.