HardenedBSD/src 859f513bin/sh sh.1, share/man/man7 mitigations.7

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+17-4share/man/man7/mitigations.7
+21-0sys/arm64/include/elf.h
+18-0sys/dev/pci/pci_pci.c
+14-3bin/sh/sh.1
+13-1sys/kern/subr_intr.c
+7-6usr.bin/diff/diffreg_new.c
+90-1478 files not shown
+250-3584 files

HardenedBSD/src df58bc8lib/libfetch common.c, lib/libnv/tests nvlist_send_recv_test.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+68-1sys/compat/linux/linux_ioctl.c
+3-8lib/libfetch/common.c
+10-0sys/compat/linux/linux_ioctl.h
+1-1sys/contrib/openzfs/include/os/freebsd/spl/sys/time.h
+0-2lib/libnv/tests/nvlist_send_recv_test.c
+82-125 files

HardenedBSD/ports d9b0527cad/qelectrotech pkg-plist, net-mgmt/geom-exporter distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+1,073-702cad/qelectrotech/pkg-plist
+60-66x11-wm/fvwm3/pkg-plist
+51-59sysutils/gstat-rs/distinfo
+36-41x11-wm/fvwm3/Makefile
+24-28sysutils/gstat-rs/Makefile.crates
+17-31net-mgmt/geom-exporter/distinfo
+1,261-92744 files not shown
+1,484-1,07950 files

HardenedBSD/src 1e36ee7share/man/man7 mitigations.7

mitigations.7: spell
DeltaFile
+2-2share/man/man7/mitigations.7
+2-21 files

HardenedBSD/src ddefff3sys/contrib/openzfs/include/os/freebsd/spl/sys time.h

Merge commit bfb276e55c76 from upstream OpenZFS (by Jessica Clarke)

  Once upon a time, 32-bit PowerPC did indeed have a 32-bit time_t, but
  FreeBSD 12.0 switched to a 64-bit time_t for PowerPC as an ABI break,
  which predates the addition of FreeBSD support to OpenZFS. Moreover,
  64-bit PowerPC has existed since FreeBSD 9.0, where __powerpc__ is also
  defined (alongside __powerpc64__ to disambiguate), which has always had
  a 64-bit time_t. This code has therefore always been wrong for all
  PowerPC variants. Fix this by limiting the 32-bit case to just i386,
  which is the only architecture in FreeBSD to have a 32-bit time_t and
  not have broken ABI, due to its special legacy compatibility status.

  Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
  Reviewed-by: Alexander Motin <alexander.motin at TrueNAS.com>
  Signed-off-by: Jessica Clarke <jrtc27 at jrtc27.com>
  Closes #18217
  Closes #18218

Reported by:    fuz

    [3 lines not shown]
DeltaFile
+1-1sys/contrib/openzfs/include/os/freebsd/spl/sys/time.h
+1-11 files

HardenedBSD/src 45c1e44sys/contrib/openzfs/include/os/freebsd/spl/sys time.h

Merge commit bfb276e55c76 from upstream OpenZFS (by Jessica Clarke)

  Once upon a time, 32-bit PowerPC did indeed have a 32-bit time_t, but
  FreeBSD 12.0 switched to a 64-bit time_t for PowerPC as an ABI break,
  which predates the addition of FreeBSD support to OpenZFS. Moreover,
  64-bit PowerPC has existed since FreeBSD 9.0, where __powerpc__ is also
  defined (alongside __powerpc64__ to disambiguate), which has always had
  a 64-bit time_t. This code has therefore always been wrong for all
  PowerPC variants. Fix this by limiting the 32-bit case to just i386,
  which is the only architecture in FreeBSD to have a 32-bit time_t and
  not have broken ABI, due to its special legacy compatibility status.

  Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
  Reviewed-by: Alexander Motin <alexander.motin at TrueNAS.com>
  Signed-off-by: Jessica Clarke <jrtc27 at jrtc27.com>
  Closes #18217
  Closes #18218

Reported by:    fuz
MFC after:      1 day
DeltaFile
+1-1sys/contrib/openzfs/include/os/freebsd/spl/sys/time.h
+1-11 files

HardenedBSD/ports 2d6255bdevel/libwasmtime distinfo Makefile

devel/libwasmtime: update: 41.0.0 -> 41.0.3

ChangeLog:      https://github.com/bytecodealliance/wasmtime/compare/v41.0.0...v41.0.3

Sponsored by:   tipi.work
DeltaFile
+3-3devel/libwasmtime/distinfo
+1-2devel/libwasmtime/Makefile
+4-52 files

HardenedBSD/src ae12f0flib/libfetch common.c

libfetch: Restore timeout functionality

PR:             293124
MFC after:      1 week
Fixes:          792ef1ae7b94 ("Refactor fetch_connect() and fetch_bind() to improve readability and avoid repeating the same DNS lookups.")
Reverts:        8f8a7f6fffd7 ("libfetch: apply timeout to SSL_read()")
Reviewed by:    eugen, imp
Differential Revision:  https://reviews.freebsd.org/D55293

(cherry picked from commit 73b82d1b0a2f09224e6d0f7a13dd73c66d740207)
(insta-mfc requested by re@)
DeltaFile
+3-8lib/libfetch/common.c
+3-81 files

HardenedBSD/src d540446usr.bin/diff diffreg_new.c

diff: Drop unnecessary casts, fix none algo

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55349
DeltaFile
+7-6usr.bin/diff/diffreg_new.c
+7-61 files

HardenedBSD/src d379432sys/kern kern_event.c, sys/sys event.h

kqueue: Make kn_sfflags unsigned

This is used to hold a copy of the original fflags, which is unsigned.

MFC after:      3 days
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D55348
DeltaFile
+1-1sys/kern/kern_event.c
+1-1sys/sys/event.h
+2-22 files

HardenedBSD/src 009be09bin/sh sh.1

sh.1: Reference editline(7)

Key bindings for command line editing are documented in editline(7).

MFC after:              3 days
Reviewed by:            jilles, ziaee
Differential Revision:  https://reviews.freebsd.org/D54767
DeltaFile
+14-3bin/sh/sh.1
+14-31 files

HardenedBSD/src 59b7f3esbin/devd devd.conf.5

devd.conf.5: Fix cross-references to devfs(4)

Fixes:          1687d77197c0 (man filesystems: move driver pages)
MFC after:      3 days
Reviewed by:    ziaee
Sponsored by:   Defenso
Signed-off-by:  Quentin Thébault <quentin.thebault at defenso.fr>
Closes:         https://github.com/freebsd/freebsd-src/pull/2015
DeltaFile
+4-4sbin/devd/devd.conf.5
+4-41 files

HardenedBSD/src d685228sbin/ifconfig ifipsec.c ifstf.c

ifconfig: Add SPDX-License-Identifier tags

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55272
DeltaFile
+2-0sbin/ifconfig/ifipsec.c
+2-0sbin/ifconfig/ifstf.c
+2-0sbin/ifconfig/sfp.c
+6-03 files

HardenedBSD/src 835813csbin/devmatch devmatch.c

devmatch: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55271
DeltaFile
+2-0sbin/devmatch/devmatch.c
+2-01 files

HardenedBSD/ports 3d0cbf2databases/rainfrog distinfo Makefile

databases/rainfrog: Update to 0.3.16

ChangeLog:      https://github.com/achristmascarl/rainfrog/releases/tag/v0.3.16
Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+3-3databases/rainfrog/distinfo
+1-1databases/rainfrog/Makefile
+4-42 files

HardenedBSD/ports bbca402x11/histui distinfo Makefile

x11/histui: Update to 0.0.9

ChangeLog:      https://github.com/jmylchreest/histui/releases/tag/v0.0.9
Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+5-5x11/histui/distinfo
+2-2x11/histui/Makefile
+7-72 files

HardenedBSD/ports 964e53fshells/xonsh distinfo Makefile

shells/xonsh: Update to 0.22.4

ChangeLog: https://github.com/xonsh/xonsh/releases/tag/0.22.4
DeltaFile
+3-3shells/xonsh/distinfo
+1-1shells/xonsh/Makefile
+4-42 files

HardenedBSD/ports 08d4df3security/aws-c-auth distinfo Makefile

security/aws-c-auth: Update to 0.9.6

ChangeLog: https://github.com/awslabs/aws-c-auth/releases/tag/v0.9.6
DeltaFile
+3-3security/aws-c-auth/distinfo
+1-1security/aws-c-auth/Makefile
+4-42 files

HardenedBSD/ports 7c778b7devel/aws-c-mqtt distinfo Makefile

devel/aws-c-mqtt: Update to 0.14.0

ChangeLog:
        https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.14.0
        https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.13.5
DeltaFile
+3-3devel/aws-c-mqtt/distinfo
+1-1devel/aws-c-mqtt/Makefile
+4-42 files

HardenedBSD/ports e270e79net-mgmt/geom-exporter distinfo Makefile.crates

net-mgmt/geom-exporter: 0.1.3

https://github.com/asomers/gstat-rs/blob/master/freebsd-geom-exporter/CHANGELOG.md#013---2026-02-18

Sponsored by:   ConnectWise
DeltaFile
+17-31net-mgmt/geom-exporter/distinfo
+7-14net-mgmt/geom-exporter/Makefile.crates
+1-2net-mgmt/geom-exporter/Makefile
+25-473 files

HardenedBSD/ports 0cb5bb3sysutils/gstat-rs distinfo Makefile.crates

sysutils/gstat-rs: 0.1.8

https://github.com/asomers/gstat-rs/blob/master/gstat/CHANGELOG.md#018---2026-02-18

Sponsored by:   ConnectWise
DeltaFile
+51-59sysutils/gstat-rs/distinfo
+24-28sysutils/gstat-rs/Makefile.crates
+1-2sysutils/gstat-rs/Makefile
+76-893 files

HardenedBSD/src 8aa5604sys/dev/nvme nvme_sim.c

nvme: Fix sim unit number to match nvme device

The CAM sim unit numbner should match the nvme device number. We need
this to match unit numbers in some wiring scenarios. For example:

hint.nvme.0.at="UEFI:PciRoot(0x3)/Pci(0x1,0x1)/Pci(0x0,0x0)"
hint.nvme.1.at="UEFI:PciRoot(0x3)/Pci(0x1,0x2)/Pci(0x0,0x0)"
hint.nvme.2.at="UEFI:PciRoot(0x3)/Pci(0x1,0x3)/Pci(0x0,0x0)"
hint.nvme.3.at="UEFI:PciRoot(0x3)/Pci(0x1,0x4)/Pci(0x0,0x0)"
hint.scbus.33.at="nvme0"
hint.nda.0.at="scbus33"
hint.scbus.34.at="nvme1"
hint.nda.1.at="scbus34"
hint.scbus.35.at="nvme2"
hint.nda.2.at="scbus35"
hint.scbus.36.at="nvme3"
hint.nda.3.at="scbus36"

If the devices that are nvme0 and nvme3 are the only ones populated, you

    [6 lines not shown]
DeltaFile
+1-1sys/dev/nvme/nvme_sim.c
+1-11 files

HardenedBSD/src c8d63d6sys/dev/nvme nvme_sim.c

nvme: fix panic if we boot w/o a namespace

If we format a drive, and then crash, we'll come back up. nvme_sim_ns
device won't attach because we don't have a namespace. Some drives (all?
I couldn't find it in the standard) send an AER with a namespace change,
which causes a NULL dereference because s_sim wasn't initialized because
we didn't attach. So, if we get into the ns_changed routine, bail early
if we didn't attach. We'll attach later, and deal with the ns correctly
if it's really there, or not attach one if it's not.

Sponsored by:           Netflix
DeltaFile
+10-0sys/dev/nvme/nvme_sim.c
+10-01 files

HardenedBSD/src 8e593a1usr.bin/fortune/datfiles freebsd-tips

fortune: fix netstat tip

netstati <mumble> 8 reports in bytes per second (averaged over 8
seconds) rather than bits per second because it reports the total
in bits over the 8 seconds...

Sponsored by:           Netflix
DeltaFile
+1-1usr.bin/fortune/datfiles/freebsd-tips
+1-11 files

HardenedBSD/src 4fb507ctools/tools/git git-arc.sh

git-arc: Tweak heuristic for email address

In the email address heuristic, assume guest-* are external
contributors. It's a new convention, apparently.

Sponsored by:           Netflix
DeltaFile
+1-0tools/tools/git/git-arc.sh
+1-01 files

HardenedBSD/src 9fa21f6lib/libnv/tests nvlist_send_recv_test.c

libnv/tests: unskip nvlist_send_recv__send_many_fds__dgram

The test passes consistently for 1000+ consecutive iterations.

PR:             260891
Reviewed by:    oshogbo
Approved by:    lwhsu (mentor)
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D55223

(cherry picked from commit fbe6da7f7592169ad7c26aa563f4c6305de1e345)
DeltaFile
+0-2lib/libnv/tests/nvlist_send_recv_test.c
+0-21 files

HardenedBSD/src b2ba413sys/kern subr_intr.c

intrng: Shuffle unhandled interrupts too

When interrupt vectors are first allocated, they get assigned to
CPU #0; at SI_SUB_SMP / SI_ORDER_SECOND (aka once we have multiple
CPUs), the intr_irq_shuffle SYSINIT clears their CPU sets with the
effect of forcing them to be assigned to new CPUs later.

In case where interrupt vectors were allocated *but not yet bound*
this code did not run, with the effect that those interrupts would
remain pinned to CPU #0 forever.  This affected the ena(4) driver,
which allocates interrupts for I/O when the device is attached but
doesn't set them up until the interface is brought up much later in
the boot process (and, crucially, long after intr_irq_shuffle runs).

Adjust intr_irq_shuffle to clear the CPU set for an interrupt source
even if it currently has no handlers, so that it will be properly
assigned to a CPU when it is used later.

Reviewed by:    andrew, mhorne

    [3 lines not shown]
DeltaFile
+13-1sys/kern/subr_intr.c
+13-11 files

HardenedBSD/src 349808dsys/dev/pci pci_pci.c

pcib: Assume a window where both the base and limit are 0 is uninitialized

Since the low bits of a window's limit are hardwired to 1, this
configuration looks like a minimally sized window at address 0.
However, PCI resources are not generally at address 0 (see the
__PCI_BAR_ZERO_VALID macro that was only defined on sparc64), and some
PCI-PCI bridges report these register values after a reset.  The
result today is a lot of spam in dmesg as the minimally-sized windows
fail to allocate.  By ignoring these windows and treating them as
closed the end result is the same, but there is less spam during boot.

Reported by:    jrtc27
Differential Revision:  https://reviews.freebsd.org/D43922
DeltaFile
+18-0sys/dev/pci/pci_pci.c
+18-01 files

HardenedBSD/src 3a96042sys/arm64/include elf.h

arm64: Add more HWCAP values

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55219
DeltaFile
+21-0sys/arm64/include/elf.h
+21-01 files

HardenedBSD/src 743a7f9bin/stty cchar.c extern.h

stty: Add SPDX-License-Identifier tags

Reviewed by: imp
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55217
DeltaFile
+2-0bin/stty/cchar.c
+2-0bin/stty/extern.h
+2-0bin/stty/gfmt.c
+2-0bin/stty/key.c
+2-0bin/stty/modes.c
+2-0bin/stty/print.c
+12-03 files not shown
+18-09 files