Welcome to NetBSD 3.1.0_PATCH.
Pull up following revision(s) (requested by nakayama in ticket #1517):
	sys/arch/sparc64/sparc64/locore.s: revision 1.217 via patch
	sys/arch/sparc64/sparc64/locore.s: revision 1.218 via patch
Fix a couple of %y register save/restore errors, inspired from OpenBSD.
  revision 1.44
  date: 2004/04/23 04:18:17;  author: marc;  state: Exp;  lines: +5 -4
  fix a couple of %y register save/restore errors
  1) don't save %y in a register that is later used before restoring %y
  2) always restore %y after calling a signal handler
  tested by drahn@, OK pval
From OpenBSD:
- reload %fprs for checking it again.
- use symbolic names for checking in %fprs.
  revision 1.51
  date: 2005/07/18 14:50:11;  author: deraadt;  state: Exp;  lines: +2 -1
  cache a copy of the fprs so we know what fp restore we should do after
  revision 1.50
  date: 2005/07/14 01:46:13;  author: deraadt;  state: Exp;  lines: +4 -4
  use symbolic names for checking in %fprs, as above
Ticket 1517.
Pull up following revision(s) (requested by reinoud in ticket #1561):
	sys/netinet/tcp_sack.c: revision 1.20
Fix alignment problems causing regular panics in tpc_sack_option on
NetBSD/alpha and NetBSD/sparc. This fixes PR#34751.
The problem most likely started to show in gcc4 and is caused by the use of
a casting to an uint32_t pointer that is later copied from using memcpy.
Gcc detects the copying of 4 bytes from an uint32_t pointer and decides to
just replace it with an aligned copy causing the trap.
Fix provided by Izumi Tsutsui and ok'd by Martin.
Pull up following revision(s) (requested by jld in ticket #1557):
	sys/miscfs/specfs/spec_vnops.c: revision 1.91 via patch
Protect spec_poll from racing against revocation and thus dereferencing a
NULL v_specinfo.  Mostly copied (with understanding) from rev 1.83's fix
to spec_ioctl, and needed for the same reason (kern/vfs_subr.c r1.231).
Pull up following revision(s) (requested by bjh21 in ticket #1562):
	sys/arch/arm/iomd/iomdkbc.c: revision 1.3
Interpret the argument to iomdkbc_set_poll() correctly.  Quite how we
got this far with it the wrong way around is beyond me.
Pull up following revision(s) (requested by hannken in ticket #1573):
	sbin/dump/snapshot.h: revision 1.3 via patch
	sbin/dump/snapshot.c: revision 1.3 via patch
	sbin/dump/main.c: revision 1.63 via patch
	sbin/dump/tape.c: revision 1.47 via patch
	sbin/dump/dump.h: revision 1.44 via patch
When using a snapshot take the snapshot raw device on further open.
Fixes PR #34923  dump(8) only dumps a corefile with -X (snapshots)
Approved by: Manuel Bouyer <bouyer@netbsd.org>
Pull up following revision(s) (requested by christos in ticket #1574):
	sys/kern/sys_process.c: revision 1.112
check for negative length in PT_COREDUMP (from Neil)
tickets 1561, 1557, 1562, 1573 and 1574
Pull up following revision(s) (requested by jld in ticket #1581):
	sys/arch/xen/xen/if_xennet_xenbus.c: revision 1.14
Recycle old buffers into new rx requests when their number reaches half of
those not tied up in active mbufs, rather than half of the total number.
(Or, to more literally translate the C, when there are at least as
many buffers waiting to be reused as outstanding rx requests.)
This prevents us from dropping off the network for a while when more
than 128 of the 256 buffers are in use by mbufs, which might not be
freed for an arbitrarily long time; the remaining buffers would stack up
on the free list but not be reclaimed until enough mbufs were eventually
freed, leaving the interface unable to receive packets until then.
ticket 1581
Pull up following revision(s) (requested by lukem in ticket #1585):
	usr.sbin/postinstall/postinstall: revision 1.30
/etc/postfix/post-install needs to be 555 not 444.
ticket #1585
Apply patch (requested by aymeric in ticket #1587)
        fix bug introduced by missing braces around a if() block in
	ticket #1511
ticket #1587
Pull up following revision(s) (requested by martin in ticket #1588):
	sys/net/if_pppoe.c: revision 1.61
Fix bogus uninitialized variable warning ifdef PPPOE_SERVER.
Noticed by Marcin Jessa on current-users.
ticket 1588
Pull up following revision(s) (requested by bouyer in ticket #1583):
	sys/dev/ata/wd.c: revision 1.334
Yet another broken seagate drive.
Ticket #1583.
Pull up following revision(s) (requested by reed in ticket #1591):
	games/banner/banner.c: revision 1.16 via patch
Check that -w width is not above maximum. (It already checks for zero or
negative.) Using width above DWIDTH may cause overflow as noted by Gruzicki
Wlodek on bugtraq.
While here replace one use of 132 with DWIDTH.