HardenedBSD/src b2e36e4sys/dev/rtwn/usb rtwn_usb_attach.h, sys/x86/iommu amd_drv.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+194-0usr.sbin/bhyve/ipc.c
+102-36sys/x86/iommu/amd_drv.c
+7-124usr.sbin/bhyve/snapshot.c
+25-11usr.sbin/bhyvectl/bhyvectl.c
+9-8usr.sbin/bhyve/ipc.h
+10-5sys/dev/rtwn/usb/rtwn_usb_attach.h
+347-18420 files not shown
+388-20326 files

HardenedBSD/src a802c35sys/dev/rtwn/usb rtwn_usb_attach.h, sys/x86/iommu amd_drv.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+194-0usr.sbin/bhyve/ipc.c
+102-36sys/x86/iommu/amd_drv.c
+7-124usr.sbin/bhyve/snapshot.c
+25-11usr.sbin/bhyvectl/bhyvectl.c
+9-8usr.sbin/bhyve/ipc.h
+10-5sys/dev/rtwn/usb/rtwn_usb_attach.h
+347-18420 files not shown
+388-20326 files

HardenedBSD/src 481314fsys/dev/rtwn/usb rtwn_usb_ep.c rtwn_usb_ep.h

rtwn: allow non-zero interface indexes

The endpoints we want won't always be on interface 0. Instead, allow the
interface index to be specified in driver_info when probing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59107
DeltaFile
+10-5sys/dev/rtwn/usb/rtwn_usb_attach.h
+9-5sys/dev/rtwn/usb/rtwn_usb_attach.c
+4-2sys/dev/rtwn/usb/rtwn_usb_var.h
+1-2sys/dev/rtwn/usb/rtwn_usb_ep.c
+2-1sys/dev/rtwn/usb/rtwn_usb_ep.h
+26-155 files

HardenedBSD/src 006920bsys/dev/rtwn if_rtwnvar.h if_rtwn_efuse.c, sys/dev/rtwn/rtl8188e/pci r88ee_attach.c

rtwn: add rtwn_efuse_preread

This would be used to switch to the "WiFi bank" before reading the rom.
The 8723bu will need this, currently a nop on all chips.

Differential Revision:  https://reviews.freebsd.org/D59106
DeltaFile
+4-0sys/dev/rtwn/if_rtwn_efuse.c
+3-0sys/dev/rtwn/if_rtwnvar.h
+1-0sys/dev/rtwn/rtl8192c/usb/r92cu_attach.c
+1-0sys/dev/rtwn/rtl8192c/pci/r92ce_attach.c
+1-0sys/dev/rtwn/rtl8188e/usb/r88eu_attach.c
+1-0sys/dev/rtwn/rtl8188e/pci/r88ee_attach.c
+11-03 files not shown
+14-09 files

HardenedBSD/src 4a2494dsys/x86/iommu amd_drv.c

amd_iommu: Bound IVHD device-entry parsing

Validate the IVRS table and every subtable length before using either
to form iterator bounds. Reject truncated typed IVHD blocks instead of
passing them to a type-specific callback.

Within each IVHD payload, correct the lower-bound comparison for
extended range entries and validate fixed-size entries, paired range
terminators, the fixed HID body, and the variable HID UID before
dereferencing or advancing. Malformed firmware can no longer drive
either iterator beyond its enclosing object.

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58724
DeltaFile
+102-36sys/x86/iommu/amd_drv.c
+102-361 files

HardenedBSD/src f49f33eusr.sbin/bhyvectl Makefile bhyvectl.c

bhyvectl: Generalize bhyve IPC code

Move the nvlist-based bhyve IPC code into a separate function.
No functional change intended.

Reviewed by:    rew
Differential Revision:  https://reviews.freebsd.org/D54652
DeltaFile
+25-11usr.sbin/bhyvectl/bhyvectl.c
+1-1usr.sbin/bhyvectl/Makefile
+26-122 files

HardenedBSD/src 04811d4usr.sbin/bhyve bhyverun.c ipc.h, usr.sbin/bhyve/aarch64 bhyverun_machdep.c

bhyve: Generalize the IPC thread

Move the code for the snapshotting IPC thread into a separate file
and define macros for adding new IPC commands.
No functional change intended.

Reviewed by:    rew
Differential Revision:  https://reviews.freebsd.org/D54650
DeltaFile
+194-0usr.sbin/bhyve/ipc.c
+7-124usr.sbin/bhyve/snapshot.c
+9-8usr.sbin/bhyve/ipc.h
+4-5usr.sbin/bhyve/bhyverun.c
+1-2usr.sbin/bhyve/amd64/bhyverun_machdep.c
+2-0usr.sbin/bhyve/aarch64/bhyverun_machdep.c
+217-1393 files not shown
+220-1409 files

HardenedBSD/src 00fb61esys/dev/hwpmc hwpmc_rapl.c, sys/modules/hwpmc Makefile

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+13-2sys/netinet6/in6_fib_algo.c
+12-1sys/netinet/in_fib_algo.c
+7-1sys/dev/hwpmc/hwpmc_rapl.c
+1-0sys/modules/hwpmc/Makefile
+33-44 files

HardenedBSD/src 4f80fc7sys/dev/hwpmc hwpmc_rapl.c, sys/modules/hwpmc Makefile

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+13-2sys/netinet6/in6_fib_algo.c
+12-1sys/netinet/in_fib_algo.c
+7-1sys/dev/hwpmc/hwpmc_rapl.c
+1-0sys/modules/hwpmc/Makefile
+33-44 files

HardenedBSD/src 9c8bcddsys/modules/hwpmc Makefile

hwpmc: build hwpmc_rapl.c into the i386 module

The module's i386 source list compiles the files that call
pmc_rapl_initialize() and pmc_rapl_finalize() but not the one that defines
them, so the i386 hwpmc.ko has both undefined and cannot be loaded.

Fixes:          a99d04f39dab ("hwpmc: add RAPL energy-counter class (AMD + Intel)")
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+1-0sys/modules/hwpmc/Makefile
+1-01 files

HardenedBSD/src d2e7fcbsys/dev/hwpmc hwpmc_rapl.c

hwpmc: do not register RAPL when the unit register reads as zero

An energy status unit of zero means one joule per raw tick, which no part
reports; it is what a hypervisor returns for an MSR it does not implement.
Both energy rows are scaled by that field, so the class would be
registered with counters that read zero forever.

Refuse it, as the class is already refused when no energy MSR responds.

Assisted-by:    Claude Code (Opus 5)
DeltaFile
+5-0sys/dev/hwpmc/hwpmc_rapl.c
+5-01 files

HardenedBSD/src 469727fsys/dev/hwpmc hwpmc_rapl.c

hwpmc: probe the RAPL unit MSR instead of faulting on it

The RAPL probe read MSR_RAPL_POWER_UNIT with a bare rdmsr().  RAPL is not
enumerated by CPUID on either vendor and the register is absent on older
Intel and AMD parts and under a hypervisor that does not emulate it, so
the read raises #GP and loading hwpmc panics the machine.

Read it with rdmsr_safe() and return ENXIO when it is not there, as this
function already does for the energy MSRs.  Both callers already drop the
class when the probe fails.

Fixes:          a99d04f39dab ("hwpmc: add RAPL energy-counter class (AMD + Intel)")
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+2-1sys/dev/hwpmc/hwpmc_rapl.c
+2-11 files

HardenedBSD/src 790817fsys/netinet in_fib_algo.c, sys/netinet6 in6_fib_algo.c

route/fib_algo: Free leaked radix_masks in radix_lockless

radix_lockless algorithm creates its own radix tree and
allocates its own radix_masks by directly calling rnh_addaddr().
However, during destruction, it only frees the radix_tree without
freeing its allocated radix_masks.
Fix the leak by calling rn_delete() during radix_destroy().

PR:             297339
Reviewed by:    melifaro
MFC after:      2 weeks
Differential Revision: https://reviews.freebsd.org/D59112
DeltaFile
+13-2sys/netinet6/in6_fib_algo.c
+12-1sys/netinet/in_fib_algo.c
+25-32 files

HardenedBSD/src 4f924c7sys/dev/e1000 if_em.h e1000_regs.h, sys/dev/ixgbe if_ix.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+229-22sys/dev/e1000/if_em.c
+13-0sys/dev/e1000/e1000_defines.h
+12-0sys/dev/ixgbe/if_ix.c
+9-0sys/dev/e1000/e1000_regs.h
+3-0sys/dev/e1000/if_em.h
+266-225 files

HardenedBSD/src 17fd152sys/dev/e1000 if_em.h e1000_regs.h, sys/dev/ixgbe if_ix.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+229-22sys/dev/e1000/if_em.c
+13-0sys/dev/e1000/e1000_defines.h
+12-0sys/dev/ixgbe/if_ix.c
+9-0sys/dev/e1000/e1000_regs.h
+3-0sys/dev/e1000/if_em.h
+266-225 files

HardenedBSD/src ce58fb7share/man/man9 iflibdd.9 iflibdi.9, sys/dev/ixgbe ixgbe_type.h if_ixv.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+43-6sys/net/iflib.c
+35-0share/man/man9/iflibdi.9
+12-1sys/dev/ixgbe/if_ixv.c
+7-4share/man/man9/iflibdd.9
+5-0sys/net/iflib.h
+2-2sys/dev/ixgbe/ixgbe_type.h
+104-131 files not shown
+107-137 files

HardenedBSD/src 27f0491sys/dev/ixgbe if_ix.c

ixgbe: Probe additional controller variants

The shared base code already selects and configures the 82598 BX,
82599 KR, 82599 SFP Express Module, X552 XFI, X553 QSFP, and X553 N
QSFP device IDs, but the FreeBSD probe table omits them while DPDK lists
them.

MFC after:      2 weeks
Sponsored by:   BBOX.io
DeltaFile
+12-0sys/dev/ixgbe/if_ix.c
+12-01 files

HardenedBSD/src 915c628sys/dev/e1000 if_em.h e1000_defines.h

igb: Report 82580 memory ECC errors

82580 exposes clear-on-read, saturating corrected error counters for
the receive and transmit packet buffers.  Its two PCIe command memories
expose RW1C indications for uncorrectable ECC errors.

Sample the packet buffer counters and PCIe indications from the regular
hardware statistics update.  Fatal recovery samples the PCIe indications
from the serialized admin path rather than the interrupt filter.  Thus,
either the regular statistics pass or recovery reads and clears each
indication, but they cannot both account it.  Also preserve indications
observed while initialization is completing.

Expose the exact packet buffer error total and observed PCIe command
memory indications under the memory_errors sysctl node.  Multiple PCIe
errors between samples can collapse into one indication per memory.

Validated on an Intel I340-T2 (82580, revision 1).  A clean boot and
three down/up cycles left the packet-buffer, PCIe, and region-specific

    [10 lines not shown]
DeltaFile
+56-12sys/dev/e1000/if_em.c
+1-0sys/dev/e1000/if_em.h
+1-0sys/dev/e1000/e1000_defines.h
+58-123 files

HardenedBSD/src 5e56a1fsys/dev/e1000 if_em.h e1000_regs.h

e1000: Recover from 82580 memory errors

82580 reports fatal parity and uncorrectable ECC errors through ICR.FER
and its four region PEIND hierarchy.  Region specific status registers
identify PCIe, DMA transmit, DMA receive, DMA host, and LAN port
memories that can leave traffic stopped.

Enable the documented DMA, PCIe, packet-buffer, and host-owned LAN
parity and ECC checks only after initializing queue and filter tables.
Leave the flexible filter parity controls under management firmware
ownership.  Capture read-clear and RW1C status in the interrupt filter
and keep FER masked until the admin task resolves the event.

Reset for a host-owned region or an unknown FER source.  Leave
management-only recovery to firmware.  Use CTRL.RST before master
disable because fatal 82580 memory errors can stop PCIe traffic.  Do not
use CTRL.DEV_RST: specification update item 9 declares that bit reserved
and says it must always be written as zero.  Wait for EEPROM auto read
completion; STATUS bit 21 is reserved on 82580, not PF_RST_DONE.

    [21 lines not shown]
DeltaFile
+184-21sys/dev/e1000/if_em.c
+12-0sys/dev/e1000/e1000_defines.h
+9-0sys/dev/e1000/e1000_regs.h
+2-0sys/dev/e1000/if_em.h
+207-214 files

HardenedBSD/src 30909e8sys/dev/ixgbe ixgbe_type.h

ixgbe: Correct the PFVFRSSRK index range comment

PFVFRSSRK contains ten 32-bit RSS key words, numbered 0 through 9.
The previous inclusive range incorrectly ended at 10.

Sponsored by:   BBOX.io

(cherry picked from commit f177ff939a91a3d710752438b13aff53d5afc725)
DeltaFile
+1-1sys/dev/ixgbe/ixgbe_type.h
+1-11 files

HardenedBSD/src 6550689sys/dev/ixgbe ixgbe_type.h if_ixv.c

ixv: Reject unsupported E610 Hyper-V VFs

E610 Hyper-V VFs use PCI configuration space communication instead of
the native PF/VF mailbox.  The generic E610 match currently attaches
native mailbox operations to those devices, and the imported Hyper-V
subdevice identifier is incorrect.

Correct the subdevice identifier to 0x00ff, as used by DPDK shared
ixgbe code, and reject that subtype until ixv has a complete Hyper-V
operations table.

Sponsored by:   BBOX.io

(cherry picked from commit 08c41a679b281505eb7f1fd0cb528f3c1fe87fed)
DeltaFile
+12-1sys/dev/ixgbe/if_ixv.c
+1-1sys/dev/ixgbe/ixgbe_type.h
+13-22 files

HardenedBSD/src 926bb8bshare/man/man9 Makefile iflibdd.9, sys/net iflib.h iflib.c

iflib: Support recoverable initialization failure

The ifdi_init method cannot report an error, so iflib always marks an
interface running and enables its interrupts after the callback returns.
Drivers whose hardware initialization depends on an unavailable peer can
only return early and leave a falsely running interface.

Add iflib_init_failed() so a callback can leave the interface stopped.
Also add a conditional reset request for asynchronous recovery: it is
discarded if the interface is administratively down when the admin task
runs, preventing a queued retry from resurrecting a stopped interface.

Do not restore saved driver flags after an MTU or capability change when
initialization failed.  Restoring the pre-init flags would overwrite the
stopped result with stale RUNNING state.

Document that reset requests require the caller to schedule the admin
task, that output remains blocked during recovery, and that iflib rather
than the driver owns the driver flags.

    [2 lines not shown]
DeltaFile
+43-6sys/net/iflib.c
+35-0share/man/man9/iflibdi.9
+7-4share/man/man9/iflibdd.9
+5-0sys/net/iflib.h
+3-0share/man/man9/Makefile
+93-105 files

HardenedBSD/src 7a6b84flib/libc/stdlib bsearch.3, lib/libc/tests/stdlib bsearch_b_test.c bsearch_test.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+134-0lib/libc/tests/stdlib/bsearch_s_test.c
+103-5lib/libc/stdlib/bsearch.3
+92-0lib/libc/tests/stdlib/bsearch_test.c
+58-0lib/libc/tests/stdlib/bsearch_b_test.c
+42-15sys/dev/dpaa/dpaa_eth.c
+37-18usr.sbin/bhyve/pci_hda.c
+466-3812 files not shown
+619-5618 files

HardenedBSD/src 9ee7b16usr.sbin/daemon daemon.8 daemon.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+23-4usr.sbin/daemon/daemon.c
+16-3usr.sbin/daemon/daemon.8
+39-72 files

HardenedBSD/src 79f020fusr.sbin/daemon daemon.8 daemon.c

daemon(8): Add option to write pidfile w/o supervising it

Co-authored-by: Michael Osipov <michaelo at FreeBSD.org>
PR:             280487
Reviewed by:    kevans, michaelo
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D46313

(cherry picked from commit fe06e383cc64fce8b604d21f8526b91fa6aecc39)
DeltaFile
+23-4usr.sbin/daemon/daemon.c
+16-3usr.sbin/daemon/daemon.8
+39-72 files

HardenedBSD/src 84ed654usr.sbin/hbsd-update hbsd-update-build

HBSD: Refer to the right branch in hbsd-update-build(8)

I forgot to switch this over to 15-STABLE as part of the branch
creation.

This is a direct commit to hardened/15-stable/main.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

HardenedBSD/src c7a5561usr.sbin/hbsd-update hbsd-update-build

HBSD: Bump copyright on hbsd-update-build(8)

The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to:         15-STABLE
See-Also:       f6cd14174c3289988d2e931862c7861e420e578a
(cherry picked from commit f115cf376fbb7564d27435c9754d773614be2eb6)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

HardenedBSD/src f115cf3usr.sbin/hbsd-update hbsd-update-build

HBSD: Bump copyright on hbsd-update-build(8)

The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to:         15-STABLE
See-Also:       f6cd14174c3289988d2e931862c7861e420e578a
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

HardenedBSD/src 3a0459bsys/dev/sound/pci hdspe-pcm.c

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-9sys/dev/sound/pci/hdspe-pcm.c
+0-91 files

HardenedBSD/src e8eba0dlib/libc/stdlib bsearch.3, lib/libc/tests/stdlib bsearch_b_test.c bsearch_test.c

Merge remote-tracking branch 'rad/freebsd/current/main' into hardened/current/master

Conflicts:
        sys/dev/sound/pci/hdspe-pcm.c (unresolved)
DeltaFile
+134-0lib/libc/tests/stdlib/bsearch_s_test.c
+103-5lib/libc/stdlib/bsearch.3
+92-0lib/libc/tests/stdlib/bsearch_test.c
+58-0lib/libc/tests/stdlib/bsearch_b_test.c
+42-15sys/dev/dpaa/dpaa_eth.c
+37-18usr.sbin/bhyve/pci_hda.c
+466-3811 files not shown
+621-4917 files