HardenedBSD/src 4f80c0estand/efi/include efizfs.h, stand/efi/libefi efizfs.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+41-8stand/efi/loader/main.c
+8-11stand/efi/libefi/efizfs.c
+3-2sys/netinet/ip_divert.c
+0-2stand/efi/include/efizfs.h
+52-234 files

HardenedBSD/src 5195362stand/efi/include efizfs.h, stand/efi/libefi efizfs.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+41-8stand/efi/loader/main.c
+8-11stand/efi/libefi/efizfs.c
+3-2sys/netinet/ip_divert.c
+0-2stand/efi/include/efizfs.h
+52-234 files

HardenedBSD/src 205489fsys/contrib/dev/broadcom/brcm80211/brcmfmac cfg80211.c sdio.c, sys/contrib/dev/broadcom/brcm80211/brcmsmac main.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+28,572-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+10,099-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phytbl_n.c
+8,689-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/cfg80211.c
+8,065-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/main.c
+5,151-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+4,650-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/sdio.c
+65,226-0472 files not shown
+127,772-4,100478 files

HardenedBSD/src bd758ebsys/netinet ip_divert.c

divert: unbreak the LINT-NOIP build

Only expose `dcb` when either `INET` or `INET6` is defined.

Reported by:    clang (`-Wunused`)
MFC after:      1 week
Fixes 5547a7bb39 ("divert: Use a better source identifier...")
Differential Revision: https://reviews.freebsd.org/D55548
DeltaFile
+3-2sys/netinet/ip_divert.c
+3-21 files

HardenedBSD/src bffd305share/man/man8 Makefile rc.8, sys/netinet ip_divert.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+53-0tools/tools/git/sanitize.lua
+16-1usr.bin/newgrp/newgrp.1
+4-2sys/netinet/ip_divert.c
+2-1share/man/man8/Makefile
+1-1tests/sys/kern/Makefile
+1-0share/man/man8/rc.8
+77-51 files not shown
+77-57 files

HardenedBSD/src b763652share/man/man8 Makefile rc.8, sys/netinet ip_divert.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+53-0tools/tools/git/sanitize.lua
+16-1usr.bin/newgrp/newgrp.1
+4-2sys/netinet/ip_divert.c
+2-1share/man/man8/Makefile
+1-1tests/sys/kern/Makefile
+1-0share/man/man8/rc.8
+77-51 files not shown
+77-57 files

HardenedBSD/src d69fc3astand/efi/include efizfs.h, stand/efi/libefi efizfs.c

loader.efi: try all ZFS pools found by efi_zfs_probe()

Remove global uint64_t pool_guid and instead iterate over all pools that
efizfs_get_zfsinfo_list() provides.

The global pool_guid used to mark that we have constructed a ZFS pool and
the pool label that was used for that was stored on a partition that is
the EFI image device handle.

First problem here is that it is too restrictive.  If the very first
device to probe is a spare member of a pool, it will be used to
instantiate a pool but (pd->pd_handle == boot_img->DeviceHandle) won't be
true, thus global pool_guid won't be populated and ZFS boot won't be
tried.

Second problem is that potentially we may find several pools, and all
should be tried to boot.  Note that the code for that is already here -
efizfs_get_zfsinfo_list() is imported by efizfs.h but was not used until
now.

    [3 lines not shown]
DeltaFile
+1-8stand/efi/libefi/efizfs.c
+6-3stand/efi/loader/main.c
+0-2stand/efi/include/efizfs.h
+7-133 files

HardenedBSD/src 784150fstand/efi/libefi efizfs.c, stand/efi/loader main.c

stand/efi: Allow RELAXED or STRICT boot policies

The RELAXED boot policy will automatically search for any root
filesystem (currently zfs only) on any device. STRICT policy only
searches on the boot device. RELEAXED will still prefer the device we
booted from, which is the smallest behavior change we should do. STRICT
may be needed for releases, though.

Sponsored by:           Netflix
Reviewed by:            glebius
Differential Revision:  https://reviews.freebsd.org/D55107
DeltaFile
+35-5stand/efi/loader/main.c
+7-3stand/efi/libefi/efizfs.c
+42-82 files

HardenedBSD/src 86dc5ddusr.bin/newgrp newgrp.1

newgrp.1: Provide examples

"These examples appear to be originally noted thirteen years ago by
Mark Saad, contributed by eadler, put into a patch by Felix Johnson,
and made into mdoc by myself. Finally, put this bug to rest." ~ziaee

PR:                     167742
Co-authored-by:         eadler, ziaee, Mark Saad
Differential Revision:  https://reviews.freebsd.org/D48877
DeltaFile
+16-1usr.bin/newgrp/newgrp.1
+16-11 files

HardenedBSD/src 7951411tools/tools/git sanitize.lua

sanitize.lua: A tool to extract interfaces from files

This is a simple too to remove all comments, extra whitespace and other
unnecessary things that may have creative content. What remains can be
just the minimal interface described by the header file. When used with
care, this can mechanically sanitize files, like some device tree
bindings file, that are only #defines that are meant to be used in
multiple context (the dts files and in C code to interpret the resulting
dtb).

Sponsored by:           Netflix
Reviewed by:            kevans
Differential Revision:  https://reviews.freebsd.org/D55087
DeltaFile
+53-0tools/tools/git/sanitize.lua
+53-01 files

HardenedBSD/src 77dc773share/man/man8 Makefile rc.8

rc.8: Add rc.suspend as an alias

Make it consistent with the other lifecycle scripts, thus making it
more findable.

Reviewed by:    ziaee
Signed-off-by:  Pat Maddox <pat at patmaddox.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/2047
DeltaFile
+2-1share/man/man8/Makefile
+1-0share/man/man8/rc.8
+3-12 files

HardenedBSD/src 112e916sys/compat/linuxkpi/dummy/include/net/page_pool helpers.h

LinuxKPI: remove dummy header now in common

page_pool/helpers.h does exist in common/include/net/page_pool/helpers.h
so we can remove the dummy header file.

Sponosred by:   The FreeBSD Foundation

(cherry picked from commit c944960a5bd7725e4d5e6805ec1e55b7de147c35)
DeltaFile
+0-0sys/compat/linuxkpi/dummy/include/net/page_pool/helpers.h
+0-01 files

HardenedBSD/src c201c9fsys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: fold the sta state machine again

In and around d9f59799fc3e7 we adjusted the initial sta state machine
implementation and unfolded some functions, duplicating code.
This version tries to undo some of that as it seems that we can get
away with doing it more cleanly these days.

There are 5 main functions for the path from INIT to RUN (UP1,2,3.1,3.2,4)
and 4 main functions for the path from RUN to INIT (DOWN1,2,3,4).
The reason there is one more on the patch up is that we can go directly
from AUTH to RUN without going through ASSOC first.
In addition there are further functions relying only on these 9 base
state change functions in order to implement the remaining possible
state transitions net80211 can do (without CSA and SLEEP).

Another change is that we no longer take a sta always through INIT/SCAN
first and then back up to AUTH, that is, we are no longer deleting the
sta from the firmware unless net80211 would also take us down to that
state and in a follow-up back up.

    [13 lines not shown]
DeltaFile
+667-945sys/compat/linuxkpi/common/src/linux_80211.c
+667-9451 files

HardenedBSD/src 7e9c07dsys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: improve crypto debug logging

Add a log entry to lkpi_ieee80211_iterate_keys() in order to be able
to determine if there are still keys available when a driver calls
into this (e.g., iwlwifi does before removing the sta to make sure
the keys are gone).

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit acba7a62b92ff62ca4ae831e9c28fc6ed4f6455a)
DeltaFile
+8-0sys/compat/linuxkpi/common/src/linux_80211.c
+8-01 files

HardenedBSD/src 64af336sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: adjust assoc check before key deletion

There is a discrepancy between the vif assoc state and the sta state
(see comment in lkpi_sta_run_to_init()).
Adjust the check in lkpi_iv_key_delete() and add it to
lkpi_sta_del_keys() so that we can take way the keys after whatever
comes first: the sta went away from AUTHORIZED (RUN) or if the vif is
no longer marked assoc.
This is needed as we may only take the sta down partially back to
State 2 (cf. 802.11-2024, Figure 11-23) and key material is no longer
valid before the vif gets cleaned up and the sta is removed entirely.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 96a57fc4bf4edca9a579cc47f9058253c11f8313)
DeltaFile
+21-9sys/compat/linuxkpi/common/src/linux_80211.c
+21-91 files

HardenedBSD/src b07c759sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: do not leak BA sessions when tearing down state

In certain cases we may tear down state of a node with 'ongoing'
BA sessions.  This can trigger a firmware crash with iwlwifi as
reported in [1] when trying to remove the sta from the firmware.

   0x2010303A | ADVANCED_SYSASSERT
   ..
   0x00000000 | umac data1 (sta id=0)
   ..
   0x0088030C | last host cmd (STA_RM)

[1] https://lists.freebsd.org/archives/freebsd-wireless/2025-November/003901.html

I hit the same problem while running regression tests after
reworking some LinuxKPI 802.11 sta state machine bits.

Add the missing calls to lkpi_sta_run_to_assoc() and lkpi_sta_run_to_init()
to make sure (through net80211) we call (*ampdu_action) with

    [11 lines not shown]
DeltaFile
+22-0sys/compat/linuxkpi/common/src/linux_80211.c
+22-01 files

HardenedBSD/src ca1e0f9sys/ofed/include/rdma ib_verbs.h

ofed: reduce usage of struct dma_attrs *dma_attrs

ib_verbs.h still uses struct dma_attrs *dma_attrs everywhere.
It is beyond my knowledge when that struct got deprecated upstream but
it is still supported by our LinuxKPI.  The problem is that the
functions called with that argument (dma_map_single_attrs,
dma_unmap_single_attrs, dma_map_sg_attrs, dma_unmap_sg_attrs) so far
are #defines in LinuxKPI and drop the last argument (attrs) so it was
never a problem.

In preparation to pass the attrs to the actual implementation in LinuxKPI,
which has gained support for them, we now pass dma_sttrs->flags which
is the expected unsigned long bit field.

If anyone has serious interest in updating our ofed implementation they
could look into this some more and remove the usage of struct dma_attrs
entirely.

Sponsored by:   The FreeBSD Foundation

    [4 lines not shown]
DeltaFile
+4-4sys/ofed/include/rdma/ib_verbs.h
+4-41 files

HardenedBSD/src 68dceb7sys/arm64/conf std.nxp, sys/arm64/qoriq qoriq_dw_pci.c

qoriq / nxp: fix spelling in device_set_desc()

The product series is called NXP QorIQ Layerscape.  Remove the extra 'e. [1]
Fix spelling of NXP, which is not NPX, in two places. [2]

Reviewed by:    mmel, emaste [1]
Reported by:    Kevin Bowling (kevin.bowling kev009.com), qoriq_dw_pci.c [2]
Differential Revision: https://reviews.freebsd.org/D55388

(cherry picked from commit a4e30909ec983f7986954e6c509ea21422561d84)
(cherry picked from commit c3ed2f3e414497ab3cf6ade17e52a87f07a547e6)
DeltaFile
+1-1sys/arm64/conf/std.nxp
+1-1sys/arm64/qoriq/qoriq_dw_pci.c
+2-22 files

HardenedBSD/src 9291447sys/compat/linuxkpi/common/include/net cfg80211.h

LinuxKPI: 802.11: add cfg80211 (*change_bss) and related structs

Needed by brcmfmac v6.19.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit b02def7c4a10fa3e2b05ebec379c5c634b87484d)
DeltaFile
+11-1sys/compat/linuxkpi/common/include/net/cfg80211.h
+11-11 files

HardenedBSD/src 927df9esys/contrib/dev/broadcom/brcm80211/brcmfmac p2p.c cfg80211.c

brcm80211: update Broadcom wireless brcmsmac and brcmfmac drivers

This version is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7 ( tag: v6.19-rc6 ).

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 9375e11f079d725d42c5b431de33044088ad14f7)
DeltaFile
+10-18sys/contrib/dev/broadcom/brcm80211/brcmfmac/p2p.c
+24-2sys/contrib/dev/broadcom/brcm80211/brcmfmac/cfg80211.c
+14-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/dmi.c
+9-5sys/contrib/dev/broadcom/brcm80211/brcmfmac/firmware.c
+4-4sys/contrib/dev/broadcom/brcm80211/brcmfmac/sdio.c
+2-2sys/contrib/dev/broadcom/brcm80211/brcmfmac/chip.c
+63-313 files not shown
+65-359 files

HardenedBSD/src 9ec3291sys/modules/brcm80211/brcmfmac Makefile

brcmfmac: deal with bus attachments to the module Makefile

As with LinuxKPI-based wireless drivers, e.g., rtw88, PCI depends
on PCI being compiled into the kernel, SDIO will depend on
MMCCAM in the kernel once supported, and USB can always be
loaded.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 98c44ccb01d9461da477ec8d784c763e4d03fb36)
DeltaFile
+10-7sys/modules/brcm80211/brcmfmac/Makefile
+10-71 files

HardenedBSD/src f77e108sys/contrib/dev/broadcom/brcm80211/brcmfmac usb.c bcdc.c

brcmfmac: make USB parts compile (and not panic right away)

Fix casts and consts and add one extra error check for a NULL pointer.
This will require [a future] linuxkpi_usb.

There are very few dongles I know off:
- the original Raspberry PI USB dongle [1]
- Cisco Linksys AE1200

The reason for making USB compile despite the limited 11n 150/300 Mbit/s
adapters is that it is the simplest way to work on cfg80211 while on the
road, not requiring a full PCIe slot or another SoC for SDIO.

Sponsored by:           The FreeBSD Foundation
Hardware donated by:    Martin Husemann (martin NetBSD.org) [1]

(cherry picked from commit 22741535bcf4b003e41c0ecd22cca578359ba434)
DeltaFile
+52-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/usb.c
+6-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/bcdc.c
+58-02 files

HardenedBSD/src a1fd73bsys/compat/linuxkpi/common/include/linux/platform_data brcmfmac.h, sys/contrib/dev/broadcom/brcm80211/brcmfmac cfg80211.c pcie.c

brcm80211: add LinuxKPI files and module Makefiles

sys/compat/linuxkpi/common/include/linux/platform_data/brcmfmac.h
is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
e5f0a698b34ed76002dc5cff3804a61c80233a7a ( tag: v6.17 ).

Currently only PCIe is made to compile.
It does load firmware (if needed, e.g., on arm64 with an alignment
issue fixed), and starts to come up.

To make it work there is a cfg80211 layer and netdevice integration
to do, so do not hold your breath just yet.

(cherry picked from commit 902136e0fe112383ec64d2ef43a446063b5e6417)
DeltaFile
+190-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/cfg80211.c
+185-0sys/compat/linuxkpi/common/include/linux/platform_data/brcmfmac.h
+117-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/pcie.c
+89-0sys/modules/brcm80211/brcmfmac/Makefile
+35-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/common.c
+34-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/msgbuf.c
+650-022 files not shown
+1,007-028 files

HardenedBSD/src a32802dsys/contrib/dev/broadcom/brcm80211/brcmfmac cfg80211.c sdio.c, sys/contrib/dev/broadcom/brcm80211/brcmsmac main.c

brcm80211: import Broadcom wireless brcmsmac and brcmfmac drivers

This version is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
e5f0a698b34ed76002dc5cff3804a61c80233a7a ( tag: v6.17 ).

We are likely only going to use the brcmfmac driver but given they
come nicely packaged in a directory structure and bwn(9) still uses
GPL-only phy files we could use some of the information from brcmsmac
and fix that (should it ever still be relevant).

(cherry picked from commit b4c3e9b5b09c829b4135aff738bd2893ed052377)
DeltaFile
+28,572-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+10,099-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phytbl_n.c
+8,477-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/cfg80211.c
+8,065-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/main.c
+5,151-0sys/contrib/dev/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+4,650-0sys/contrib/dev/broadcom/brcm80211/brcmfmac/sdio.c
+65,014-0127 files not shown
+116,023-0133 files

HardenedBSD/src 64681bbsys/contrib/dev/athk/ath10k ce.c

ath10k: update Atheros/QCA's ath10k driver

This version is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
05f7e89ab9731565d8a62e3b5d1ec206485eeb0b ( tag: v6.19 ).

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 083f8f33304ab105d0b556bdc244c9fa73068b67)
DeltaFile
+8-8sys/contrib/dev/athk/ath10k/ce.c
+8-81 files

HardenedBSD/src cacb3a7. ObsoleteFiles.inc, share/man/man4 rtw88.4

rtw88: remove more references to rtw88fw

When I removed the Realtek rtww8x firmware from base I missed to
add rtw88fw.4 to ObsoleteFiles.inc [1].
While adding this, also remove a leftover reference in rtw88.4.

Reported by:    Herbert J. Skuhra (herbert gojira.at) [1]
Fixes:          cf94672363d6

(cherry picked from commit 3f4213f00ac5eea0a56cebeb1ba9f64a2489a956)
DeltaFile
+2-3share/man/man4/rtw88.4
+2-1ObsoleteFiles.inc
+4-42 files

HardenedBSD/src d4270besys/modules/rtw89 Makefile

rtw89: module Makefile add USB bus attachments

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit f19cb3c72b001f5ca2204888bfab50e2f388547d)
DeltaFile
+30-13sys/modules/rtw89/Makefile
+30-131 files

HardenedBSD/src 6ef3096sys/contrib/dev/rtw89 pci.c core.c

rtw89: harmonize all MODULE_DEPEND to rtw89

rtw89 came like rtw88 was done.  Given rtw88 once was split up rtw89
got modelled the same way.  Clean this up too.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 7fc5c8df4c90a2067c936e3026be6bd6840cd5ec)
DeltaFile
+0-8sys/contrib/dev/rtw89/pci.c
+5-0sys/contrib/dev/rtw89/core.c
+5-0sys/contrib/dev/rtw89/debug.c
+3-0sys/contrib/dev/rtw89/usb.c
+13-84 files

HardenedBSD/src e5643f3sys/contrib/dev/rtw89 debug.c fw.h

rtw89: cleanup static_assert() calls

These days we can use static_assert() without trouble so remove the
FreeBSD-specific rtw89_static_assert implementation.  This reduces
the diff to upstream and will ease future driver updates.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 57b839612b7abb891057f1efe380c509664f868b)
DeltaFile
+0-12sys/contrib/dev/rtw89/debug.c
+0-8sys/contrib/dev/rtw89/fw.h
+0-8sys/contrib/dev/rtw89/phy.c
+0-6sys/contrib/dev/rtw89/core.h
+0-6sys/contrib/dev/rtw89/rtw8851b.c
+0-6sys/contrib/dev/rtw89/rtw8852c.c
+0-463 files not shown
+0-589 files

HardenedBSD/src db3daf9sys/modules/rtw88 Makefile

rtw88: Add bus attachments to the module Makefile

In addition to PCIe we will support USB and also prepare for SDIO (still
disabled locally).  The module SRCS are split up into a common part,
which we always add.  All three bus parts are guarded by a local
variable in the Makefile.
In addition the PCI parts require PCI to be compiled into the kernel.
We add that check in case of, e.g., SoCs with SDIO but no PCI, which
may not have PCI in the kernel config and thus the module would fail
to attach.
USB has no additional check as it is fully loadable and does not have
to be in a kernel config.
SDIO depends on an MMCCAM-enabled kernel but is otherwise loadable.

While we could, we are not splitting the various bus attachments into
individual modules as we generally do not do that in FreeBSD. [1]

Sponsored by:   The FreeBSD Foundation
Discussed with: imp and jhb (2022, 2024), see also 17732dd8f01b [1]

    [4 lines not shown]
DeltaFile
+61-25sys/modules/rtw88/Makefile
+61-251 files