HardenedBSD/src 8e6843dlib/libc/stdio vfprintf.c printf-pos.c, share/man/man5 src.conf.5

libc: drop NO_FP_LIBC support

NO_FP_LIBC was added in 2004 to save space by disabling FP support in
*printf()/*scanf(). The size benefit is negligible on modern systems
and conflicts with assumptions made by current base utilities.

Remove the option and always build libc with floating-point support.

Reported by:    Oskar Holmlund <eovholmlund at gmail com>
MFC after:      2 weeks
DeltaFile
+0-14lib/libc/stdio/vfprintf.c
+0-12lib/libc/stdio/printf-pos.c
+0-12lib/libc/stdio/vfwprintf.c
+0-10lib/libc/stdio/vfscanf.c
+0-8lib/libc/stdio/vfwscanf.c
+1-5share/man/man5/src.conf.5
+1-617 files not shown
+1-8413 files

HardenedBSD/src afbb21bsys/conf NOTES

aq: remove from NOTES; it's unfortunately amd64 only

Unfortunately the aq driver is using readl/writel calls instead
of bus space routines.

This broke, well, everything else.
Fixes:          c75eff16ef54aaae7b5dc52ed894cc73a855f469
DeltaFile
+0-2sys/conf/NOTES
+0-21 files

HardenedBSD/src cd22fd0sys/powerpc/include atomic.h

powerpc: Add ISA 2.06 sub-word atomic set/clear

Add atomic_set/clear_short/char for doing 8-bit and 16-bit operations
more efficiently on "newer" architectures (POWER7 and later).

Piggybacks on b31abc95eb.
DeltaFile
+56-26sys/powerpc/include/atomic.h
+56-261 files

HardenedBSD/src 35caa56tests/sys/netpfil/ipfw log.sh Makefile

tests/ipfw: add a test for ipfw(4) log rules that write to bpf(4)
DeltaFile
+95-0tests/sys/netpfil/ipfw/log.sh
+1-0tests/sys/netpfil/ipfw/Makefile
+96-02 files

HardenedBSD/src 65b4bf7sys/netpfil/ipfw ip_fw_bpf.c ip_fw_private.h

ipfw: refactor how we store bpf tap points

Make the tap database belong to ip_fw_chain, but leave the default "ipfw0"
tap per-vnet.  This is only slightly better than keeping the database per-
vnet, as the bpf name space is per-vnet.  However, we yet have only single
ipfw chain.  Whenever multiple chains will coexist, this needs to be
addressed.

Require the chain lock to make modifications to the database.

Move tap allocation to a later ruleset build stage, when all rule numbers
are known already.  This fixes a panic introduced by 3daae1ac1d82.

Fixes:  3daae1ac1d82ecdcd855101bab5206e914b12350
DeltaFile
+34-26sys/netpfil/ipfw/ip_fw_bpf.c
+8-3sys/netpfil/ipfw/ip_fw_private.h
+4-5sys/netpfil/ipfw/ip_fw_sockopt.c
+2-2sys/netpfil/ipfw/ip_fw_log.c
+1-0sys/netpfil/ipfw/ip_fw2.c
+49-365 files

HardenedBSD/src 1a7b74dsys/netpfil/ipfw ip_fw2.c

ipfw: in a vnet destructor use NET_EPOCH_WAIT()

The lock grab & drop predates epoch(9) introduction to the network
stack and it doesn't provide a true guarantee that all threads that
may use ipfw configuration have finished.  Also the lock prevented
from sleepable operations when freeing the rules.
DeltaFile
+5-5sys/netpfil/ipfw/ip_fw2.c
+5-51 files

HardenedBSD/src 6dc12ecusr.sbin/spi spi.c spi.8

spi: "-S" option for continuous stream from standard input to bus

created to allow addressable leds to be driven by abusing spi bus as waveform generator. this might have other uses for similar "permanent" spi transfers

Differential Revision:  https://reviews.freebsd.org/D54734
Reviewed by:    adrian
DeltaFile
+31-10usr.sbin/spi/spi.c
+7-0usr.sbin/spi/spi.8
+38-102 files

HardenedBSD/src 325baf0sys/vm swap_pager.c

vm/swap_pager.c: silence compiler warning

Initialize pindex in swap_pager_getpages_locked() before the loop
actually calculating it by skipping bogus pages.  Compiler is worried
that loop might never assign to it, which actually cannot happen.

Sponsored by:   The FreeBSD Foundation
Fixes:  d198ad51ea73bbb162336923a387f52b0b1c1f1d
MFC after:      1 week
DeltaFile
+1-1sys/vm/swap_pager.c
+1-11 files

HardenedBSD/src c75eff1sys/amd64/conf GENERIC, sys/conf NOTES

aq: Add to amd64 GENERIC and to sys/conf/NOTES

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D54633
DeltaFile
+2-0sys/conf/NOTES
+1-0sys/amd64/conf/GENERIC
+3-02 files

HardenedBSD/src d198ad5sys/vm swap_pager.c

swap_pager_getpages(): some pages from ma[] might be bogus

Same as vnode_pager_generic_getpages_async(), swap_pager_getpages() must
handle a possibility of the provided page run to include bogus_page on
some positions, when called from sendfile_swapin().  The swap pager is
used for tmpfs vnodes.

In particular, the bogus page must not be used for pindex calculation,
we better not update the flags on it or wait for the flag clearing, and
we must not call vm_page_valid() because the function expects busy page.

This was bisected down to 72ddb6de1028426 (unix: increase
net.local.(stream|seqpacket).(recv|send)space to 64 KiB),
which is somewhat surprising, but apparently reasonable because it
allowed the run of more than one page for page-in from the swap pager,
which now might include valid pages replaced by bogus one.

In collaboration with:  pho
Reviewed by:    glebius, markj

    [3 lines not shown]
DeltaFile
+29-8sys/vm/swap_pager.c
+29-81 files

HardenedBSD/src b02ddb5sys/vm swap_pager.c

swap_pager_getpages(): assert that bp->b_pages[] is accessed in bounds

Reviewed by:    glebius, markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54713
DeltaFile
+3-0sys/vm/swap_pager.c
+3-01 files

HardenedBSD/src 3fe275csys/kern kern_sendfile.c

sendfile: remove calculation of unused bsize

Reviewed by:    glebius, markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54713
DeltaFile
+3-6sys/kern/kern_sendfile.c
+3-61 files

HardenedBSD/src f8b8fcdlib/libc/stdlib tdestroy.c, sys/netpfil/ipfw ip_fw_table.c ip_fw_table_value.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+22-269sys/netpfil/ipfw/ip_fw_table.c
+20-103sys/netpfil/ipfw/ip_fw_table_value.c
+96-0tests/sys/netpfil/ipfw/table.sh
+13-66sys/netpfil/ipfw/ip_fw_sockopt.c
+35-41sys/netpfil/ipfw/ip_fw_table.h
+32-34lib/libc/stdlib/tdestroy.c
+218-51314 files not shown
+262-57520 files

HardenedBSD/src b0c13e7sys/netpfil/ipfw ip_fw_table.c ip_fw_table_value.c

ipfw: remove locking workarounds in the table code

Before the "upper half lock" became sleepable the table manipulation code
needed sophisticated workarounds to recover from races, where the lock is
temporarily dropped to do malloc(M_WAITOK).  Remove all these workarounds
as they are no longer needed.

Differential Revision:  https://reviews.freebsd.org/D54580
DeltaFile
+13-240sys/netpfil/ipfw/ip_fw_table.c
+20-92sys/netpfil/ipfw/ip_fw_table_value.c
+35-41sys/netpfil/ipfw/ip_fw_table.h
+68-3733 files

HardenedBSD/src e3caa36sys/netpfil/ipfw ip_fw_sockopt.c ip_fw_table.c

ipfw: make the upper half lock sleepable

The so called upper half ipfw lock is not used in the forwarding path.  It
is used only during configuration changes and servicing system events like
interface arrival/departure or vnet creation.  The original code drops the
lock before malloc(M_WAITOK) and then goes into great efforts to recover
from possible races.  But the races still exist, e.g. create_table() would
first check for table existence, but then drop the lock.  The change also
fixes unlock leak in check_table_space() in a branch that apparently was
never entered.

Changing to a sleepable lock we can reduce a lot of existing complexity
associated with race recovery, and as use the lock to cover other
configuration time allocations, like recently added per-rule bpf(4) taps.

This change doesn't remove much of a race recovery code, to ease bisection
in case of a regression.  This will be done in a separate commit.  This
change just removes lock drops during configuration events.  The only
reduction is removal of get_map(), which is a straightforward reduce to a

    [11 lines not shown]
DeltaFile
+13-66sys/netpfil/ipfw/ip_fw_sockopt.c
+9-29sys/netpfil/ipfw/ip_fw_table.c
+14-23sys/netpfil/ipfw/ip_fw_dynamic.c
+10-10sys/netpfil/ipfw/ip_fw_private.h
+1-12sys/netpfil/ipfw/ip_fw_table_value.c
+0-5sys/netpfil/ipfw/ip_fw_nat.c
+47-1452 files not shown
+47-1538 files

HardenedBSD/src 7eac31ctests/sys/netpfil/ipfw table.sh Makefile

tests/ipfw: add a simple fuzzing test for ipfw tables

Reviewed by:            pouria, ae
Differential Revision:  https://reviews.freebsd.org/D54579
DeltaFile
+96-0tests/sys/netpfil/ipfw/table.sh
+2-1tests/sys/netpfil/ipfw/Makefile
+98-12 files

HardenedBSD/src f102a18sys/net if.c

net: on interface detach purge all its routes before detaching protocols

Otherwise, a forwarding thread may use the interface being detached.  This
is a regression from 0d469d23715d, which manifests itself as a reliably
reproducible panic in in6_selecthlim().  Note that there are old bug
reports about such a panic, and I believe this change will not fix them,
as their nature is not due to a screwed up detach sequence, but due to
lack of proper epoch(9) based synchronization between the detach and
forwarding.

Reviewed by:            pouria
Reported & tested by:   jhibbits
PR:                     292162
Fixes:                  0d469d23715d690b863787ebfa51529e1f6a9092
Differential Revision:  https://reviews.freebsd.org/D54721
DeltaFile
+2-2sys/net/if.c
+2-21 files

HardenedBSD/src 74cac74sys/dev/mxge if_mxge.c

mxge(4): avoid clang 21 warning in NO-IP configuration

Building the LINT-NOIP kernel on amd64 with clang 21 results in a
-Werror warning similar to:

    sys/dev/mxge/if_mxge.c:1846:44: error: variable 'sum' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
     1846 |                     cksum_offset, sizeof(sum), (caddr_t)&sum);
          |                                                          ^~~

Indeed, if both `INET` and `INET6` are undefined, `sum` is never
initialized. Initialize it to zero to silence the warning.

Reviewed by:    jhibbits
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D54730
DeltaFile
+1-1sys/dev/mxge/if_mxge.c
+1-11 files

HardenedBSD/src 988555elib/libc/stdlib tdestroy.c

tdestroy: don't visit one-child node twice

Change tdestroy() to immediately free a node with no right child as
soon as it is encountered. Currently, such nodes are visited twice
before deletion.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54699
DeltaFile
+32-34lib/libc/stdlib/tdestroy.c
+32-341 files

HardenedBSD/src 689663dsys/kern kern_time.c

Initialize CLOCK_UPTIME for itmer events

Since we move to implement Linux's CLOCK_MONOTONIC with CLOCK_UPTIME, we
broke the some timer support for Linux. Fix this by initializing
CLOCK_UPTIME as a posix clock so we can use in that context.

PR:                     292496
MFC After:              5 days
Fixes:                  108de784513d
Sponsored by:           Netflix
Reviewed by:            kib
Differential Revision:  https://reviews.freebsd.org/D54746
DeltaFile
+1-0sys/kern/kern_time.c
+1-01 files

HardenedBSD/src c940f5c. RELNOTES

RELNOTES: LinuxKPI based wireless drivers are now avail on RISC-V

This was enabled after a report [1] that iwlwifi(4) works on
RISC-V.

[1] https://mail-archive.freebsd.org/cgi/getmsg.cgi?fetch=5947+0+archive/2026/freebsd-wireless/20260112.freebsd-wireless

Sponsored by:   The FreeBSD Foundation
DeltaFile
+4-0RELNOTES
+4-01 files

HardenedBSD/src fd34f54share/man/man4 termios.4

termios.4: Cross-reference stack(9) for STATUS

If the kernel is built without stack(9) (options STACK),
then the mentioned sysctl(8) kern.tty_info_kstacks will not be found.

MFC after:              3 days
Reviewed by:            kib, ziaee
Differential Revision:  https://reviews.freebsd.org/D54701
DeltaFile
+4-2share/man/man4/termios.4
+4-21 files

HardenedBSD/src 75c591bsys/dev/smartpqi smartpqi_prototypes.h smartpqi_request.c

smartpqi: Avoid declaring extern inline functions

Each C file is compiled separately so these functions can't be inlined
except in the file where they are defined.  Since these functions aren't
used outside smartpqi_request.c, just do the simple thing and make them
private to that file.

Reported by:    gcc
Reviewed by:    jrhall
Fixes:          c558eca47970 ("smartpqi: update to version 4660.0.2002")
Differential Revision:  https://reviews.freebsd.org/D54732
DeltaFile
+0-4sys/dev/smartpqi/smartpqi_prototypes.h
+2-2sys/dev/smartpqi/smartpqi_request.c
+2-62 files

HardenedBSD/src f89f7e5usr.bin/sockstat main.c

sockstat: improve formataddr() according to style(9)

Reviewed by:    des
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D54412
DeltaFile
+4-4usr.bin/sockstat/main.c
+4-41 files

HardenedBSD/src e2b2482sys/conf kern.mk, sys/kern subr_smp.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+79-67sys/x86/cpufreq/hwpstate_amd.c
+33-16usr.sbin/bhyve/config.c
+13-0sys/kern/subr_smp.c
+9-0usr.sbin/bhyve/config.h
+7-1sys/sys/smp.h
+3-0sys/conf/kern.mk
+144-847 files not shown
+153-8813 files

HardenedBSD/src 0a25074sys/kern subr_bus.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+1-1sys/kern/subr_bus.c
+1-11 files

HardenedBSD/src d836daesys/netgraph/netflow netflow_v9.c

ng_netflow v9: fix template re-announcement using packet count

Increment fe->sent_packets after export9_send().
Previously, NetFlow v9 templates were only re-announced based on
time, ignoring the packet count parameter (`templ_packets`).

PR:             270083
Reviewed by:    glebius pouria
Approved by:    glebius (mentor)
MFC after:      1 week
Sponsored by:   Subcarpathian BSD User Group
DeltaFile
+1-0sys/netgraph/netflow/netflow_v9.c
+1-01 files

HardenedBSD/src 1d819aa. .mailmap

mailmap: translate siva@'s personal email

Reviewed by:            lwhsu
Approved by:            lwhsu (mentor)
Differential Revision:  https://reviews.freebsd.org/D54744
DeltaFile
+1-0.mailmap
+1-01 files

HardenedBSD/src 33f2f30share/misc committers-src.dot

committers-src: add myself (siva@)

Reviewed by:            lwhsu
Approved by:            lwhsu (mentor)
Differential Revision:  https://reviews.freebsd.org/D54744
DeltaFile
+3-0share/misc/committers-src.dot
+3-01 files

HardenedBSD/src 97b177fsys/dev/dwc if_dwc.c

dwc: prepare for IPv6 transmit checksum offloading

No functional change intended.

MFC after:      3 days
DeltaFile
+3-3sys/dev/dwc/if_dwc.c
+3-31 files