HardenedBSD/src 2bcf220sys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/src 01d69basys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/ports f266e9b. UPDATING, graphics/nvidia-drm-kmod-580 Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+32-0UPDATING
+5-5www/fabio/distinfo
+8-0graphics/nvidia-drm-kmod-580/Makefile
+8-0x11/nvidia-kmod-580/Makefile
+8-0x11/nvidia-driver-580/Makefile
+8-0x11/linux-nvidia-libs-580/Makefile
+69-554 files not shown
+230-9060 files

HardenedBSD/src 7b6be00sys/dev/hyperv/vmbus/x86 hyperv_reg.h, sys/x86/x86 local_apic.c

Hyper-V: Detect Extended Destination ID support

Hyper-V advertises support for the Extended Destination ID standard via
bit 2 of the value returned in the EAX register when the hypervisor
stack properties are queried via CPUID.

This is based on a commit to the Linux kernel, as there does not seem
to be any other documentation of this feature.

Reviewed by:    Souradeep Chakrabarti
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55432
DeltaFile
+9-0sys/x86/x86/local_apic.c
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+15-02 files

HardenedBSD/src 8dd9a0dsys/x86/x86 local_apic.c

Bhyve: Detect Extended Destination ID support

Bhyve advertises support for the Extended Destination ID standard via
bit 0 (aka CPUID_BHYVE_FEAT_EXT_DEST_ID) of the value returned in the
EAX register when Bhyve features are queried via CPUID.

MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55431
DeltaFile
+8-0sys/x86/x86/local_apic.c
+8-01 files

HardenedBSD/src 49b6254sys/amd64/vmm x86.c, sys/x86/include bhyve.h

vmm: Move defines from x86.c to x86/bhyve.h

The values CPUID_BHYVE_FEATURES and CPUID_BHYVE_FEAT_EXT_DEST_ID are
useful for guests, not just hosts; so they belong in a header file in
sys/x86/include rather than simply in the .c file implementing the
bhyve host side.

The original addition of these defines took place without adding a
copyright statement, but since I'm moving them into a new file I've
added the original author's standard copyright (Amazon).

MFC after:      3 weeks
Fixes:  313a68ea20b4 ("bhyve: Add CPUID_BHYVE_FEATURES leaf")
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55430
DeltaFile
+35-0sys/x86/include/bhyve.h
+1-4sys/amd64/vmm/x86.c
+36-42 files

HardenedBSD/src 9b18ba2sys/x86/x86 local_apic.c

Xen: Detect Extended Destination ID support

Xen advertises support for the Extended Destination ID standard via
bit 5 (aka XEN_HVM_CPUID_EXT_DEST_ID) of the value returned in the
EAX register when Xen features are queried via CPUID.

MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55429
DeltaFile
+6-0sys/x86/x86/local_apic.c
+6-01 files

HardenedBSD/src 8c986d1sys/contrib/xen/arch-x86 cpuid.h

x86/cpuid: add CPUID flag for Extended Destination ID support

Introduce the CPUID flag to be used in order to signal the support for
using an extended destination ID in IO-APIC RTEs and MSI address
fields. Such format expands the maximum target APIC ID from 255 to
32768 without requiring the usage of interrupt remapping.

The design document describing the feature can be found at:

http://david.woodhou.se/15-bit-msi.pdf

Signed-off-by: Roger Pau Monné <roger.pau at citrix.com>
Reviewed-by: Jan Beulich <jbeulich at suse.com>
DeltaFile
+7-0sys/contrib/xen/arch-x86/cpuid.h
+7-01 files

HardenedBSD/src 9ab5aa3sys/x86/include kvm.h, sys/x86/x86 local_apic.c

KVM: Detect Extended Destination ID support

KVM advertises support for the Extended Destination ID standard via
bit 15 of the value returned in the EAX register when KVM features
are queried via CPUID.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55427
DeltaFile
+11-0sys/x86/x86/local_apic.c
+1-0sys/x86/include/kvm.h
+12-02 files

HardenedBSD/src b0e1b10sys/x86/include apicvar.h, sys/x86/x86 io_apic.c

io_apic: Support APIC Extended Destination IDs

If APIC Extended Destination ID support is enabled, use it in APIC RTEs
by allowing APIC IDs up to 2^15 - 1 and encoding the high bits into
Intel "reserved" bits per the standard.

Reviewed by:    kib
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55889
DeltaFile
+7-0sys/x86/x86/io_apic.c
+1-0sys/x86/include/apicvar.h
+8-02 files

HardenedBSD/src 02f29c1sys/x86/x86 msi.c

msi: Support APIC Extended Destination IDs

If APIC Extended Destination ID support is enabled, use it in MSIs by
allowing APIC IDs up to 2^15 - 1 and encoding the high bits into
Intel "reserved" bits per the standard.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55426
DeltaFile
+9-2sys/x86/x86/msi.c
+9-21 files

HardenedBSD/src d9db6d7sys/x86/include apicvar.h, sys/x86/x86 local_apic.c

x86: Add stub for Extended Destination ID support

Without an IOMMU, the APIC standard only allows 8 bits of Destination
ID for MSI messages, limiting us to 256 CPUs.  While IOMMUs can allow
for more than 256 CPUs to be supported, they are not necessarily
desirable in virtualized environments.

The Extended Destination ID standard authored by David Woodhouse uses
7 "Reserved" bits for the high bits of a 15-bit Extended Destination
ID in order to address this: http://david.woodhou.se/ExtDestId.pdf

Add a loader tunable machdep.apic_ext_dest_id to control the use of
this feature; the default value (-1) means "autodetect" while 0 and
1 mean disabled and enabled respectively.

Code to detect host support in Xen, Hyper-V, KVM, and Bhyve will come
in future commits, as will the code to use this setting in msi_map and
ioapic_program_intpin.


    [4 lines not shown]
DeltaFile
+15-0sys/x86/x86/local_apic.c
+1-0sys/x86/include/apicvar.h
+16-02 files

HardenedBSD/src 5809c9asys/x86/x86 io_apic.c

io_apic: Don't route to APIC ID > 255

I/O APIC Redirection Table Entries use 8 bits to encode the Destination
ID.  Attempting to route an IRQ to a higher APIC ID would result in it
being silently routed to the value reduced modulo 256, causing a panic
if the IRQ fired since the receiving CPU would not expect that IRQ.

Instead, print a warning and mark the interrupt as invalid, resulting
in it being forcibly masked.

Reviewed by:    kib
Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55857
DeltaFile
+13-3sys/x86/x86/io_apic.c
+13-31 files

HardenedBSD/src 1d0ccd6sys/x86/x86 io_apic.c

x86: Add struct ioapic_intsrc.io_valid

As of this commit, io_valid is always set to 1; but a future commit
will set it to 0, at which point IOART_INTMSET will be set to forcibly
disable interrupt sources regardless of whether they are requested to
be "masked".

Reviewed by:    kib
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D56006
DeltaFile
+11-3sys/x86/x86/io_apic.c
+11-31 files

HardenedBSD/src f350063sys/x86/x86 local_apic.c

clapic_handle_intr: KASSERT isrc != NULL

If an interrupt arrives at a CPU which isn't expecting that particular
vector, intr_lookup_source will return an isrc of NULL and we'll panic
when intr_execute_handlers increments *isrc->is_count.

Place a KASSERT a few nanoseconds earlier in order to leave some more
breadcrumbs for the next person to trip over this behaviour.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55851
DeltaFile
+3-0sys/x86/x86/local_apic.c
+3-01 files

HardenedBSD/ports 89c58bdcomms/meshcore-cli distinfo Makefile

comms/meshcore-cli: upgrade to 1.5.4
DeltaFile
+3-3comms/meshcore-cli/distinfo
+2-2comms/meshcore-cli/Makefile
+5-52 files

HardenedBSD/ports 77ff661comms/py-meshcore distinfo Makefile

comms/py-meshcore: upgrade to 2.3.3
DeltaFile
+3-3comms/py-meshcore/distinfo
+1-1comms/py-meshcore/Makefile
+4-42 files

HardenedBSD/ports 942c4a2databases/pg_textsearch distinfo Makefile

databases/pg_textsearch: Update to 1.0.0
DeltaFile
+3-3databases/pg_textsearch/distinfo
+1-1databases/pg_textsearch/Makefile
+2-0databases/pg_textsearch/pkg-plist
+6-43 files

HardenedBSD/src 72bb61bsys/amd64/conf NOTES, sys/x86/conf NOTES

i386/amd64/NOTES: Add some missing devices

The following devices to x86: ocs_fc aq vge tws
And this to amd64: ufshci

These are in GENERIC, but not NOTES.

Sponsored by:           Netflix
DeltaFile
+5-0sys/x86/conf/NOTES
+3-0sys/amd64/conf/NOTES
+8-02 files

HardenedBSD/src ccc235fsys/dev/vmgenc vmgenc_acpi.c

vmgenc: fix typo in MODULE_DEPEND declaration

The random_harvestq dependency was registered under the misspelled
name "vemgenc" instead of "vmgenc", causing the dependency to not
be associated with the correct module.

Signed-off-by: Christos Longros <chris.longros at gmail.com>
Reviewed by: cem, imp
Differential Revision:  https://reviews.freebsd.org/D56012
DeltaFile
+1-1sys/dev/vmgenc/vmgenc_acpi.c
+1-11 files

HardenedBSD/ports 2bc7874net-mgmt/grepcidr Makefile

net-mgmt/grepcidr: assign maintainership.

PR:             294024
DeltaFile
+1-1net-mgmt/grepcidr/Makefile
+1-11 files

HardenedBSD/ports 46dca90security/py-google-cloud-kms distinfo Makefile

security/py-google-cloud-kms: Update to 3.12.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-kms-v3.12.0/packages/google-cloud-kms/CHANGELOG.md

Reported by:    portscout
DeltaFile
+3-3security/py-google-cloud-kms/distinfo
+3-3security/py-google-cloud-kms/Makefile
+6-62 files

HardenedBSD/src e0af444sys/net rtsock.c route.h, sys/net/route route_ctl.c nhop_ctl.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+50-0tests/sys/netinet6/ndp.sh
+2-36sys/net/route/route_ctl.c
+13-21sys/netlink/route/rt.c
+10-22sys/net/rtsock.c
+4-13sys/net/route/nhop_ctl.c
+0-17sys/net/route.h
+79-10941 files not shown
+120-22147 files

HardenedBSD/ports b35026e. UPDATING, graphics/nvidia-drm-kmod-580 Makefile

x11/nvidia-driver, x11/nvidia-kmod, x11/linux-nvidia-libs, graphics/nvidia-drm*-kmod, x11/nvidia-settings, x11/nvidia-xconfig: Update to 595.58.03

Update to latest Production Branch of drivers 595.58.03:
https://www.nvidia.com/en-us/drivers/details/265873/

Linux counterparts for x11/linux-nvidia-libs:
https://www.nvidia.com/en-us/drivers/details/265870/

Also bump -devel variant to match with master ports, as Production
Branch [PB] of drivers have now higher version than New Feature
Branch [NFB] of drivers.

As this update drops a bunch of old (pre-Turing generation of
architectures) GPUs as done in -devel variants updated 20260103,
add -580 variant of legacy branch of driver.

Currently, this is exactly the same version before this update.
(580.142)


    [2 lines not shown]
DeltaFile
+32-0UPDATING
+8-0x11/nvidia-kmod-580/Makefile
+8-0x11/linux-nvidia-libs-580/Makefile
+8-0graphics/nvidia-drm-kmod-580/Makefile
+8-0x11/nvidia-driver-580/Makefile
+7-0graphics/nvidia-drm-latest-kmod-580/Makefile
+71-041 files not shown
+200-6147 files

HardenedBSD/ports 814341bmisc/usbrh-libusb Makefile

misc/usbrh-libusb: assign maintainership.

PR:             293977
Reported by:    rodrigo
Approved by:    sanpei
DeltaFile
+1-1misc/usbrh-libusb/Makefile
+1-11 files

HardenedBSD/src faf5532sys/net rtsock.c route.h, sys/net/route route_ctl.c nhop_ctl.c

Merge remote-tracking branch 'origin/freebsd/current/main' into hardened/current/master

Conflicts:
        sys/netinet/ip_input.c (resolved)
        sys/netinet/raw_ip.c (resolved)
        sys/netinet/udp_usrreq.c (resolved)
        sys/netinet6/in6_pcb.c (resolved)
        sys/netinet6/in6_proto.c (resolved)
DeltaFile
+50-0tests/sys/netinet6/ndp.sh
+2-36sys/net/route/route_ctl.c
+13-21sys/netlink/route/rt.c
+10-22sys/net/rtsock.c
+4-13sys/net/route/nhop_ctl.c
+0-17sys/net/route.h
+79-10941 files not shown
+120-22147 files

HardenedBSD/ports ea4da10www/fabio distinfo Makefile

www/fabio: Update 1.6.4 => 1.6.11, fix runtime

A recent update to Consul causes Fabio to fail to register itself in the
service directory.  Consul has apparently become stricter in its
interpretation of IPv4 addresses and fails to recognize an IPv4 address
surrounded by square brackets.  Versions prior to 1.22 permitted this.
Fabio (prior to 1.6.11) sends its IPv4 address wrapped in square
brackets and will fail to register on a newer Consul.

Changelog:
https://github.com/fabiolb/fabio/blob/master/CHANGELOG.md#v1611-2025-12-09

While here replace PORTVERSION with DISTVERSION.

PR:             294048
Approved by:    blanket (fix runtime)
Sponsored by:   UNIS Labs
MFH:            2026Q1
DeltaFile
+5-5www/fabio/distinfo
+2-3www/fabio/Makefile
+7-82 files

HardenedBSD/ports a4c0aadirc/halloy distinfo Makefile.crates, security/openssl36/files patch-CVE-2026-2673

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+331-289irc/halloy/distinfo
+479-0security/openssl36/files/patch-CVE-2026-2673
+165-144irc/halloy/Makefile.crates
+49-0www/zine-ssg/distinfo
+44-0www/zine-ssg/Makefile
+36-0www/zine-ssg/files/patch-build.zig
+1,104-43355 files not shown
+1,408-55761 files

HardenedBSD/src beab2fesys/net/route route_ctl.c

routing: Include opt_route.h in route_ctl.c

Fix incorrect removal of opt_route.h header in route_ctl.c

Reported by:    Jenkins
Fixes:          254b23eb1f54 ("routing: Retire ROUTE_MPATH compile option")
Differential Revision: https://reviews.freebsd.org/D55884
DeltaFile
+1-0sys/net/route/route_ctl.c
+1-01 files

HardenedBSD/ports 80a13e9net-mgmt/observium Makefile distinfo

net-mgmt/observium: update 24.12 → 26.1

PR:     293295
DeltaFile
+5-4net-mgmt/observium/Makefile
+3-3net-mgmt/observium/distinfo
+8-72 files