Integrate OpenSSL commit 9fe4603b8245425a4c46986ed000fca054231253:
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Feb 12 14:55:32 2013 +0000

    Check DTLS_BAD_VER for version number.

    The version check for DTLS1_VERSION was redundant as
    DTLS1_VERSION > TLS1_1_VERSION, however we do need to
    check for DTLS1_BAD_VER for compatibility.

    PR:2984
    (cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)

Approved by:	benl
Import vendor fixes:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).
Import OpenSSL 1.0.1f.

Approved by:	so (delphij), benl (silence)
Import OpenSSL 1.0.1g.

Approved by:	benl (maintainer)
Import OpenSSL 1.0.1h.

Approved by:	so (delphij)
Remove unused variable.

Sponsored by:	Yandex LLC
Introduce new per-thread lock to protect the list of requests.

This allows to slightly simplify svc_run_internal() code: if we processed
all the requests in a queue, then we know that new one will not appear.

MFC after:	2 weeks
Remove st_idle variable, duplicating st_xprt.

MFC after:	2 weeks
Initialize the pbuf counter for directio using SYSINIT, instead of
using a direct hook called from kern_vfs_bio_buffer_alloc().
Mark ffs_rawread.c as requiring both ffs and directio options to be
compiled into the kernel.  Add ffs_rawread.c to the list of ufs.ko
module' sources.

In addition to stopping breaking the layering violation, it also
allows to link kernel when FFS is configured as module and DIRECTIO is
enabled.

One consequence of the change is that ffs_rawread.o is always linked
into the module regardless of the DIRECTIO option.  This is similar to
the option QUOTA and ufs_quota.c.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Remove write-only local variable.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Split RPC pool threads into number of smaller semi-isolated groups.

Old design with unified thread pool was good from the point of thread
utilization.  But single pool-wide mutex became huge congestion point
for systems with many CPUs.  To reduce the congestion create several
thread groups within a pool (one group for every 6 CPUs and 12 threads),
each group with own mutex.  Each connection during its registration is
assigned to one of the groups in round-robin fashion.  File affinify
code may still move requests between the groups, but otherwise groups
are self-contained.

MFC after:	2 weeks
Sponsored by:	iXsystems, Inc.
Use atomics to modify numvnodes variable.

This allows to mostly avoid lock usage in getnewvnode_[drop_]reserve(),
that reduces number of global vnode_free_list_mtx mutex acquisitions
from 4 to 2 per NFS request on ZFS, improving SMP scalability.

Reviewed by:	kib
MFC after:	2 weeks
Sponsored by:	iXsystems, Inc.
In preparation for ASLR [1] support add WITH_PIE to support building with -fPIE.

This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.

Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]

Mark known build failures as NO_PIE for now.

The only known runtime failure was rtld.

[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by:		Shawn Webb <lattera@gmail.com>
Discussed between:	des@ and Shawn Webb [2]
Regen after r267233
Remove extra branching from r267232.

MFC after:	2 weeks
Resolve a deadlock setting the USB configuration index from userspace
on USB HUBs by moving the code into the USB explore threads. The
deadlock happens because child devices of the USB HUB don't have the
expected reference count when called from outside the explore
thread. Only the HUB device itself, which the IOCTL interface locks,
gets the correct reference count.

MFC after:	3 days
Refresh a comment.  The VM_STACK option was eliminated in r43209.

Sponsored by:	EMC / Isilon Storage Division
acpiconf(8): document 'k' option

	Add missing documentation for the 'k' option based on reading the source
	code.
Remove an unnecessary variable reassignment

And it would be bad if 'm' was different from '*m0' at this
point, since we've already populated the SG list.

MFC after:	3 days
Fix TSO support on VMware Fusion

Apparently for VMware Fusion (and presumably VMware Workstation/Player
since the PR states TSO is broken there too, but I cannot test), the
TCP header pseudo checksum calculated should only include the protocol
(IPPROTO_TCP) value, not also the lengths as the stack does instead.

VMware ESXi seems to ignore whatever value is in the TCP header checksum,
and it is a bit surprising there is a different behavior between the
VMware products. And it is unfortunate that on ESXi we are forced to do
this extra bit of work.

PR:		kern/185849
MFC after:	3 days