Integrate OpenSSL commit 9fe4603b8245425a4c46986ed000fca054231253:
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Feb 12 14:55:32 2013 +0000

    Check DTLS_BAD_VER for version number.

    The version check for DTLS1_VERSION was redundant as
    DTLS1_VERSION > TLS1_1_VERSION, however we do need to
    check for DTLS1_BAD_VER for compatibility.

    PR:2984
    (cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)

Approved by:	benl
Import vendor fixes:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).
Import OpenSSL 1.0.1f.

Approved by:	so (delphij), benl (silence)
Import OpenSSL 1.0.1g.

Approved by:	benl (maintainer)
netinet/in.h: Expose htonl(), htons(), ntohl() and ntohs() in strict POSIX
mode.

Put the htonl(), htons(), ntohl() and ntohs() declarations under
__POSIX_VISIBLE >= 200112. POSIX.1-2001 and newer require these to be
exposed from <netinet/in.h> (as well as <arpa/inet.h>).

Note that it may be unnecessary to check __POSIX_VISIBLE >= 200112 because
older versions of POSIX and the C standard do not define this header.
However, other places in the same file already perform the check.

PR:		188316
Submitted by:	Christian Neukirchen
Fix a typo.

Sponsored by:	The FreeBSD Foundation
Reorganize this Makefile so that all the bsd.*.mk bits are in one
section at the bottom.

Reviewed by:	imp
When usermode loaded non-default segment selector into the %gs,
correctly prepare KGSBASE msr to restore the user descriptor base on
the last swapgs during return to usermode.

Reported and tested by:	peterj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Add missing , in converted font output

Submitted by:	Claude Buisson
Add support for the unmapped i/o to mfi(4).

Tested by:	Nicholas Esborn <nick@desert.net>
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
For old CPUs, map the 64 first MB of RAM as it used to be. Some ports
(XScale mainly) expects the memory located before the kernel to be mapped,
and use it to allocate the page tables, the various stacks, etc.
A better fix would probably be to rewrite the various bla_machdep.c to stop
using that RAM, but I'm not so inclined to do it, especially since I don't
have hardware for all of them.
Do not hand the VM the memory used for stacks/page tables/etc.
Add VGAROM 8x8, 8x14 and 8x16 fonts for vt(4)

These are converted from syscons(4) cp437 fonts.
Fix pf(4) to build with MAXCPU set to 256.  MAXCPU is actually a count,
not a maximum ID value (so it is a cap on mp_ncpus, not mp_maxid).
Minor style knit.
Update number of tests.

Suggested by:	jmmv
In the grab function, keep the bit 6 on in the IER, on XScale, using 0
turns the UART off, which is unfortunate if one want to use it as a console.
Correct KASSERT strings

Rows refer to height and cols to width.
Add rwlock to struct dadq.  A panic could occur when a large number of
addresses performed DAD at the same time.
In uart_bus_grab(), use the ier_mask instead of a custom hack for XScale.

Suggested by:	jmg