privilege is needed to run rc_check.
In effect this means /etc/rc.d/foobar check can now be run as a regular
user.
Discussed with robert@ during g2k12.
ok todd@

signatures from observation.
ok mikeb@ jsing@ henning@ deraadt@

ok guenther@

ok deraadt@ tedu@, wording tweaks jmc@

OK espie@ kettines@

character after the '\0'; ok guenther@

ok robert@

ok robert@

three things that it needed from there: INET_ADDRSTRLEN, INET6_ADDRSTRLEN,
and struct in_addr.  Add protecting #ifndefs to netinet6?/in6?.h for those.
ok deraadt@

ok deraadt@

Add __restrict bits for tdelete()
ok deraadt@

util.h.
ok guenther

param.h symbol reduction.
ok guenther

suggested by deraadt@

Pointed out by Joachim Schipper (joachim at joachimschipper.nl)

Based on a note from Steffen Daode Nurpmeso (sdaoden at googlemail.com)
ok jmc@

ok ajacoutot@, krw@, deraadt@

initially from robert at peichaer dot org with some enhancement by halex@
ok halex@

out of the box.
ok deraadt@ pirofti@

NL_{ARG,LANG,MSG,SET,TEXT}MAX with newer POSIX.
Hide {FLT,DBL}_{DIG,MAX,MIN} and {PASS,TMP,NL_N}_MAX with newer XPG.
Make _POSIX_NGROUPS_MAX and _POSIX_OPEN_MAX conditional on the POSIX
version, like _POSIX_TZNAME_MAX already is.
Add some more _POSIX_* and _XOPEN_* 'specified' limits.
ok kettenis@

of the latter.  Permits the misleading lib/libpthread/Makefile to be
removed
discussed with deraadt@

scanning for free space if the hint isn't available.
also, on further inspection, this will prevent pmap_prefer from "improving"
our hint.

MI float.h which pulls in and defines the values that are needed from
there, and repair sys/limits.h so that it defines the values it needs
as well (depending on POSIX version, XPG version, etc).  guenther has
a more exact selection of that coming for limits.h.
this also fixes a few mistakes for the vax.
reviewed by kettenis and guenther.

all the symbols that POSIX says they must and fewer that they can't and,
most importantly, to not require a specific ordering of headers.
ports testing by naddy@
ok millert@ deraadt@

``-upper_bound % upper_bound''.  Simplifies the code and makes it the
same on both ILP32 and LP64 architectures, and also slightly faster on
LP64 architectures by using a 32-bit remainder instead of a 64-bit
remainder.
Pointed out by Jorden Verwer on tech@
ok deraadt; no objections from djm or otto

clear out the entire requested area, not just a perfect fit.  second,
use mquery to check for room to avoid getting an address we don't like
and having to send it back.

so that it can't get a signal while still running on the parent thread's
stack.  Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added.  This is an ABI change, so switch syscall
numbers and bump lib majors this time.
ok deraadt@ matthew@

descriptor starvation, we can crank the default user file descriptor
limits.

in order to span the the entire cache.  second, on free use the same offset
to put things in the cache instead of always starting at zero.
ok otto

- everything that has prereq will also do includes, add it late, so that
gnu stuff (the only part with prereq) happens late.
- new RUN_MAKE snippet, to be able to have the makefile magically decide
between Makefile.bsd-wrapper and Makefile.
So there's no longer any need to remember complicated rules: add it to
RDIRS if it just wants make includes, add it to PRDIRS if it wants prereq too,
and that's all.
okay deraadt@, miod@

overallocating and then releasing unneeded memory pages.
ok otto

ok gilles@

from the most recent version, use the implementation namespace for variables
in inline functions, and add __restrict as specified.
ok millert@

Bulk build test by naddy.

on descriptors, this can be achieved thanks to the new getdtablecount()
system call. application may provide a reserve count to ensure that the
recvmsg() call is not called when they don't have enough descriptors to
work properly.
change the API so that transient errors that can be retried immediately
are retried within the function right away, whereas transient errors for
which the application may want to take action will set errno to EAGAIN.
ok deraadt@ and henning@

preventing them being locally allocated as dynamic ports.
If AMT is configured with the same IP address as the host (and, in
the case of redirection/https ports, if the relevant feature is
enabled), it will steal packets sent to its ports.
ok mikeb@. kettenis@ thinks it's probably a good idea.

Update SYNOPSIS for setkey() to show it's in <stdlib.h>
ok jmc@, millert@

and valloc() are not in the current version, while posix_memalign() mkstemp(),
and mkdtemp() are, and setstate()'s argument has lost a bogus 'const'.
ok millert@ jmc@ espie@ kettenis@; ports build testing by naddy@

These are useful if you're behind a bad nat with short timeouts as often
found in airport lounges and hotels. If the keepalives fail because the
network goes away (moving out of wireless reception, swapping cables etc)
your connections are more likely to drop so this is a double-edged sword.
ok henning@

from sys/unistd.h to unistd.h.
From Brad; ok millert and me

daemon is not active (happens often to me, as I forget which box has
which daemons).
okay ajacoutot@

provide IP22 and IP28 kernels, as well as the ECOFF bootblock.
No objection from deraadt@