MFS security patches which seem to have accidentally not reached HEAD:

Fix insufficient message length validation for EAP-TLS messages.

Fix Linux compatibility layer input validation error.

Security:	FreeBSD-SA-12:07.hostapd
Security:	FreeBSD-SA-12:08.linux
Security:	CVE-2012-4445, CVE-2012-4576
With hat:	so@
Make FDT blob compatible with Raspberry Pi firmware.

Rasperry Pi firmware has a set of hardcoded pathes it uses to fill
FDT with system-specific information like display resolution, memory
size, UART and SDHCI clocks, ethernet MAC address. Handle two of them:

- Add placeholder for ethernet MAC address
- Move display node out of "axi" node
Look for MAC address in FDT tree nodes that are usb network devices and
have either "mac-address" or "local-mac-addrress" property.
Use MIPS_PHYS_TO_DIRECT_UNCACHED rather than a homegrown version which is not
compatible with 32-bit kernels.
Multiple fixes for BCM2835 framebuffer

- Get resolution settings from FDT blob
- Properly handle 24 and 16 bits per pixel
- Add colors support for text console
Implement a HAL method to set a 64 bit TSF value.

TODO: implement it (and test) for the AR5210/AR5211.
Add the HAL wrapper for settsf64.
Fix up the nexttbtt -> TSF delta calculation to not wrap ridiculously
on the 802.11n NICs.

The 802.11n NICs return a TBTT value that continues far past the 16 bit
HAL_BEACON_PERIOD time (in TU.)  The code would constrain nextslot to
HAL_BEACON_PERIOD, but it wasn't constraining nexttbtt - the pre-11n
NICs would only return TU values from 0 -> HAL_BEACON_PERIOD.  Thus,
when nexttbtt exceeded 64 milliseconds, it would not wrap (but nextslot
did) which lead to a huge tsfdelta.

So until the slot calculation is converted to work in TSF rather than
a mix of TSF and TU, "make" the nexttbtt values match the TU assumptions
for pre-11n NICs.

This fixes the crazy deltatsf calculations but it doesn't fix the
non-convergent tsfdelta issue.  That'll be fixed in a subsequent commit.
Use a 64 bit TSF write to update the TSF adjust, rather than a 32 bit
TSF write.

The TSF_L32 update is fine for the AR5413 (and later, I guess) 11abg NICs
however on the 11n NICs this didn't work.  The TSF writes were causing
a much larger time to be skipped, leading to the timing to never
converge.

I've tested this 64 bit TSF read, adjust and write on both the
11n NICs and the AR5413 NIC I've been using for testing.  It works
fine on each.

This patch allows the AR5416/AR9280 to be used as a TDMA member.
I don't yet know why the AR9280 is ~7uS accurate rather than ~3uS;
I'll look into it soon.

Tested:

* AR5413, TDMA slave (~ 3us accuracy)
* AR5416, TDMA slave (~ 3us accuracy)
* AR9280, TDMA slave (~ 7us accuracy)
Now that we have working USB keyboard add ukbd to the syscons-enabling
part of config
Remove no longer needed quirk.

Submitted by:	Mark Johnston
Catch up with r243046. KTR buffer can be changed at runtime.
According to r221124, the default NFS server and client are no longer
experimental.
Document that getpeername(2) and getsockname(2) can fail with EINVAL.

Reviewed by:	glebius
- Use sin6_scope_id instead of sin6_addr.s6_addr[2].
- Support a flag for ALLOW/BLOCK in source-specific multicast (RFC 4604).
Document sin6_scope_id handling change and bump FreeBSD_version to 1000025.
Move sndbuf_setmap() output about buffer addresses from the general verbose
output to sound verbose output, where all other sndbuf messages live.
Remove "clone manager: " message from verbose dmesg. It is pointless to
print values that are statically hardcoded few lines above that.
Strip trailing newline.
The tramp stuff isn't dependent on DDB, so always add these to the
CLEANFILES list.