HardenedBSD/src dfe8596sys/compat/linux linux_socket.c, sys/dev/ixgbe if_ix_mdio_hw.c if_ix_mdio.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+181-0sys/dev/ixgbe/if_ix_mdio_hw.c
+158-0sys/dev/ixgbe/if_ix_mdio.c
+126-0sys/compat/linux/linux_socket.c
+51-0tests/sys/netpfil/pf/limiters.sh
+36-9sys/net/iflib.c
+34-0sys/dev/ixgbe/if_ix_mdio.h
+586-927 files not shown
+727-7133 files

HardenedBSD/src afac750sys/compat/linux linux_socket.c, sys/dev/ixgbe if_ix_mdio_hw.c if_ix_mdio.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+181-0sys/dev/ixgbe/if_ix_mdio_hw.c
+158-0sys/dev/ixgbe/if_ix_mdio.c
+126-0sys/compat/linux/linux_socket.c
+51-0tests/sys/netpfil/pf/limiters.sh
+36-9sys/net/iflib.c
+34-0sys/dev/ixgbe/if_ix_mdio.h
+586-927 files not shown
+727-7133 files

HardenedBSD/src 17e443fshare/man/man4 ciss.4, sys/net/route nhop_ctl.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+45-1share/man/man4/ciss.4
+2-2sys/net/route/nhop_ctl.c
+47-32 files

HardenedBSD/ports f3ab7ebfilesystems/amazon-efs-utils distinfo, graphics/jkqtplotter/files/examples/all-in-tabs main.cpp

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+2,928-2,882science/avogadrolibs/pkg-plist
+1,707-1,184security/bitwarden-cli/files/packagejsons/package-lock.json
+0-1,111net-p2p/pulsar-client-cpp/files/patch-cc30a7b5f52c6d6d7ff94d93a9509fc3f6becc83
+1,044-0graphics/jkqtplotter/files/examples/all-in-tabs/main.cpp
+889-0filesystems/amazon-efs-utils/distinfo
+365-417security/rustls-ffi/distinfo
+6,933-5,594202 files not shown
+9,608-7,185208 files

HardenedBSD/ports 034f6d8devel/py-maturin distinfo Makefile.crates

devel/py-maturin: Update to 1.13.1

Approved by:    kai
Changelog:      https://github.com/PyO3/maturin/releases/tag/v1.13.1
Differential Revision:  https://reviews.freebsd.org/D56419
DeltaFile
+41-41devel/py-maturin/distinfo
+19-19devel/py-maturin/Makefile.crates
+1-2devel/py-maturin/Makefile
+61-623 files

HardenedBSD/ports 66fef6ex11-servers/xlibre-ephyr Makefile, x11-servers/xlibre-nest Makefile

x11/{nvidia-driver,slim},x11-{drivers,servers}/*: Update XLibre to 25.1.3

Tested by:      acm@
With hat:       xlibre
DeltaFile
+3-3x11-servers/xlibre-server/distinfo
+1-1x11-servers/xlibre-server/Makefile
+1-1x11-servers/xlibre-ephyr/Makefile
+1-1x11-servers/xlibre-nest/Makefile
+1-1x11-servers/xlibre-server/Makefile.version
+1-1x11-servers/xlibre-vfb/Makefile
+8-82 files not shown
+10-108 files

HardenedBSD/src 3fade68sys/net iflib.c

iflib: accurately count bytes/segments for TSO

When using software based ifnet counters, iflib has not factored
TSO into account when reporting the segments and bytes sent.
So it will underreport NIC bandwidth by a small percent,
and will undercount sent segments by a large factor.
Fix this by calculating the number of added segments the NIC
will send, and add header size multiplied by that number
to arrive at a correct accounting of segments and bytes sent.
This makes these software counters directly comparable to
hardware counters.

Doing this requires moving the calculation into iflib_encap() where
we have already parsed the packet and know the header size, MSS, etc.

Differential Revision: https://reviews.freebsd.org/D56338
Sponsored by: Netflix
DeltaFile
+20-8sys/net/iflib.c
+20-81 files

HardenedBSD/src 52e7958sys/net iflib.c

iflib: ignore reclaim coalescing when low on tx descriptors

If we are low on TX descriptors, bypass iflib_txq_can_reclaim()
and force a reclaim. This is intended to reduce the number of
output drops under heavy load when using simple transmit.

Differential Revision: https://reviews.freebsd.org/D56339
Sponsored by: Netflix
DeltaFile
+16-1sys/net/iflib.c
+16-11 files

HardenedBSD/src f46d75csys/dev/ixgbe ixgbe_x540.c ixgbe_common.c

ixgbe: improve MDIO performance by reducing semaphore/IPC delays

Each MDIO transfer takes 8ms, and all of that is spent in a set
of DELAY() calls, which is consuming a LOT of CPU.

* Change the timeout in ixgbe_hic_unlocked() - doing IPC to the
  on-chip firmware - to a 1uS delay and bump timeout appropriately.
  This seems to finish in a couple of microseconds on my local
  test devices.

* Change the 2ms sleep in ixgbe_release_swfw_sync_X540() to 2ms
  for EEPROM/flash, and 10uS otherwise.  10uS seems to work fine
  on my local testing, but the config EEPROM doesn't read right
  without this extra delay.

The first change shouldn't change the driver behaviour, but the
latter change is more intrusive and needs some wider testing.
(My guess here is that there SHOULD have been some completion
check somewhere in the EEPROM/flash IO path, and these sleeps

    [8 lines not shown]
DeltaFile
+15-1sys/dev/ixgbe/ixgbe_x540.c
+2-2sys/dev/ixgbe/ixgbe_common.c
+17-32 files

HardenedBSD/src cfec995sys/conf files, sys/dev/ixgbe if_ix_mdio_hw.c if_ix_mdio.c

ixgbe: add MDIO bus support

This works enough to let me see the marvell switch on the MDIO bus.

It uses clause 22, which ixgbe's existing MDIO code doesn't currently
support, so it's implemented in a new source file.

Since mdio(4) is now required, add it where appropriate to GENERIC kernels.

Reviewed by:    kbowling
Differential Revision:  https://reviews.freebsd.org/D50128
DeltaFile
+181-0sys/dev/ixgbe/if_ix_mdio_hw.c
+158-0sys/dev/ixgbe/if_ix_mdio.c
+34-0sys/dev/ixgbe/if_ix_mdio.h
+33-0sys/dev/ixgbe/if_ix_mdio_hw.h
+14-1sys/dev/ixgbe/if_ix.c
+4-0sys/conf/files
+424-13 files not shown
+432-29 files

HardenedBSD/ports 1d7c8ccsecurity/rustls-ffi distinfo Makefile.crates, security/rustls-ffi/files patch-powerpc64le patch-cargo-crates_aws-lc-sys-0.24.0_aws-lc_include_openssl_target.h

security/rustls-ffi: Update to 0.15.2
DeltaFile
+365-417security/rustls-ffi/distinfo
+181-207security/rustls-ffi/Makefile.crates
+2-20security/rustls-ffi/files/patch-powerpc64le
+0-20security/rustls-ffi/files/patch-cargo-crates_aws-lc-sys-0.24.0_aws-lc_include_openssl_target.h
+1-2security/rustls-ffi/Makefile
+549-6665 files

HardenedBSD/ports 3947231mail/nextcloud-mail distinfo Makefile

mail/nextcloud-mail: Update to 5.7.9
DeltaFile
+3-3mail/nextcloud-mail/distinfo
+1-1mail/nextcloud-mail/Makefile
+4-42 files

HardenedBSD/ports e4d7ea5www/nextcloud-news distinfo Makefile

www/nextcloud-news: Update to 28.1.0
DeltaFile
+3-3www/nextcloud-news/distinfo
+1-1www/nextcloud-news/Makefile
+4-42 files

HardenedBSD/ports 2400ac2www/nextcloud-groupfolders distinfo Makefile

www/nextcloud-groupfolders: Update to 21.0.7
DeltaFile
+3-3www/nextcloud-groupfolders/distinfo
+1-1www/nextcloud-groupfolders/Makefile
+4-42 files

HardenedBSD/ports 55b9b62www/nextcloud-forms distinfo Makefile

www/nextcloud-forms: Update to 5.2.7
DeltaFile
+3-3www/nextcloud-forms/distinfo
+1-1www/nextcloud-forms/Makefile
+4-42 files

HardenedBSD/ports 6957912www/nextcloud-deck distinfo Makefile

www/nextcloud-deck: Update to 1.17.1
DeltaFile
+3-3www/nextcloud-deck/distinfo
+1-1www/nextcloud-deck/Makefile
+4-42 files

HardenedBSD/ports 562e1e6www/nextcloud-contacts distinfo Makefile

www/nextcloud-contacts: Update to 8.4.4
DeltaFile
+3-3www/nextcloud-contacts/distinfo
+1-1www/nextcloud-contacts/Makefile
+4-42 files

HardenedBSD/ports 6c2e530www/nextcloud-appointments distinfo Makefile

www/nextcloud-appointments: Update to 2.7.2
DeltaFile
+3-3www/nextcloud-appointments/distinfo
+1-1www/nextcloud-appointments/Makefile
+4-42 files

HardenedBSD/ports 80da017security/openssl40 pkg-message distinfo

security/openssl40: Update to 4.0.0

This is now a release version
DeltaFile
+1-8security/openssl40/pkg-message
+3-3security/openssl40/distinfo
+1-1security/openssl40/Makefile
+1-1security/openssl40/version.mk
+6-134 files

HardenedBSD/src eb02795stand/powerpc/boot1.chrp boot1.c

boot1.chrp: Improve comment for the SLOF hack

Since this original comment was written, the actual issue in SLOF
was diagnosed and documented in commit 424089a0fc, which fixed it
for loader(8).  Update the comment in boot1 to be more informative
to future readers.

MFC after:      3 days
Reviewed by:    jhibbits, adrian
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56470
DeltaFile
+5-8stand/powerpc/boot1.chrp/boot1.c
+5-81 files

HardenedBSD/ports 5bfb09edevel/py-array-api-strict Makefile

devel/py-array-api-strict: migrate to numpy (2)

PR: 294328
DeltaFile
+2-2devel/py-array-api-strict/Makefile
+2-21 files

HardenedBSD/ports 0742097dns/dnstracer-rs distinfo Makefile.crates

dns/dnstracer-rs: update to 1.2.5
DeltaFile
+147-145dns/dnstracer-rs/distinfo
+72-71dns/dnstracer-rs/Makefile.crates
+1-3dns/dnstracer-rs/Makefile
+220-2193 files

HardenedBSD/src 42af3dasys/conf newvers.sh

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-6sys/conf/newvers.sh
+1-61 files

HardenedBSD/src adf160binclude unistd.h, lib/libthr libthr.3

Merge remote-tracking branch 'tor/freebsd/15-stable/main' into hardened/15-stable/main

Conflicts:
        sys/conf/newvers.sh (unresolved)
DeltaFile
+25-0lib/libthr/libthr.3
+2-4sys/kern/vfs_aio.c
+6-0sys/sys/fcntl.h
+5-0sys/conf/newvers.sh
+4-1include/unistd.h
+4-1sys/kern/vfs_syscalls.c
+46-64 files not shown
+50-1110 files

HardenedBSD/ports da3395cgraphics/hdr_histogram Makefile, graphics/hdr_histogram/files patch-src_hdr__endian.h.patch patch-src_hdr__time.c.patch

HBSD: Fix HdrHistogram's issues

This patch allegedly fixes the issues regarding graphics/hdr_histogram.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
Obtained-from:  https://lists.freebsd.org/archives/freebsd-ports/2026-April/009367.html
DeltaFile
+23-0graphics/hdr_histogram/files/patch-src_hdr__endian.h.patch
+11-0graphics/hdr_histogram/files/patch-src_hdr__time.c.patch
+1-0graphics/hdr_histogram/Makefile
+35-03 files

HardenedBSD/src 49e9b30sys/cddl/compat/opensolaris/kern opensolaris_cmn_err.c

dtrace: Improve dmesg kernel message prefix

Provide intuitive log search keywords and increased system consistency.

MFC after:              2 weeks
Reported by:            mav
Reviewed by:            0mp, dteske
OpenZFS change:         d45c8d648 (Improve dmesg kernel message prefix)
Differential Revision:  https://reviews.freebsd.org/D55765
DeltaFile
+7-7sys/cddl/compat/opensolaris/kern/opensolaris_cmn_err.c
+7-71 files

HardenedBSD/src b2aea7ashare/man/man4 e6000sw.4

e6000sw.4: Mention MV88E6171

Fixes:  680e6e30c020 (etherswitch: Add minimal support for mv88e6170)
Reviewed by:            jhibbits
Differential Revision:  https://reviews.freebsd.org/D56455
DeltaFile
+3-1share/man/man4/e6000sw.4
+3-11 files

HardenedBSD/src a154d72sys/netinet sctp_structs.h

sctp(4): Fix a typo in a source code comment

- s/initited/initiated/

Obtained from:  NetBSD
MFC after:      3 days
DeltaFile
+1-1sys/netinet/sctp_structs.h
+1-11 files

HardenedBSD/ports 6d5f5e4filesystems/amazon-efs-utils distinfo Makefile.crates, filesystems/amazon-efs-utils/files patch-src_watchdog_____init____.py patch-src_efs__utils__common_proxy.py

filesystems/amazon-efs-utils: New port

Amazon EFS mount helper and watchdog utilities. Provides mount_efs(8) to mount
EFS filesystems over NFSv4.1, optionally via a local stunnel-like proxy
(efs-proxy) that terminates TLS 1.2 and handles IAM authentication using SigV4.
A watchdog daemon, started by mount_efs, monitors the proxy and restarts it if
it dies.

FreeBSD-specific adaptations:
- Binary installed as mount_efs, not mount.efs
- Uses /sbin/mount_nfs with nfsv4,minorversion=1,oneopenown,retrycnt=1
- Watchdog enumerates /var/run/efs state files cross-checked with
  "mount -t nfs" (FreeBSD has no /proc/mounts and mount(8)/nfsstat(8)
  do not expose the client TCP port)
- aarch64 build fix: the libc crate does not expose max_align_t for
  aarch64-unknown-freebsd; substitute align_of::<u128>() in s2n-tl

Sponsored by:   Netflix
DeltaFile
+889-0filesystems/amazon-efs-utils/distinfo
+443-0filesystems/amazon-efs-utils/Makefile.crates
+86-0filesystems/amazon-efs-utils/files/patch-src_watchdog_____init____.py
+84-0filesystems/amazon-efs-utils/Makefile
+48-0filesystems/amazon-efs-utils/files/patch-src_efs__utils__common_proxy.py
+41-0filesystems/amazon-efs-utils/files/patch-src_efs__utils__common_mount__options.py
+1,591-07 files not shown
+1,710-013 files

HardenedBSD/src ab1d659stand/efi/loader/arch/arm exec.c, stand/efi/loader/arch/arm64 exec.c

loader.efi: Defer efi_translate(e_entry) until after bi_load

bi_load itself loads various things into the staging area which can
cause it to grow, which may result in the staging area moving, including
the kernel. Therefore the address we get for the kernel entry point
prior to bi_load may not be correct afterwards when we actually call it,
and so we must defer the translation.

On arm and riscv (but not arm64, which predates both of them in
loader.efi and did not gain a copy of arm's added printf when arm
support was added) we also printf this entry point to the console, which
we can no longer do since bi_load calls ExitBootServices, so remove this
printf that, in practice, seems to not be so useful, given nobody ever
felt the need to add it to arm64. If anyone really feels this is an
important printf to have then bi_load will need to be split so we can
call printf after all the loading and potential reallocation of the
staging area, but before ExitBootServices is called.

We may also want to make this code more uniform and shared between the

    [10 lines not shown]
DeltaFile
+2-3stand/efi/loader/arch/riscv/exec.c
+2-3stand/efi/loader/arch/arm/exec.c
+2-1stand/efi/loader/arch/arm64/exec.c
+6-73 files