HardenedBSD/src 7ccf9ae — . Makefile.inc1

Makefile.inc1: Adjust mkimg bootstrap versions

Stream-optimized VMDK support was merged to stable/15 with
__FreeBSD_version 1501504.

Sponsored by:   Amazon
DeltaFile
+3-2Makefile.inc1
+3-21 files

HardenedBSD/src aa59f16 — . Makefile.inc1, sys/sys param.h

__FreeBSD_version: Bump for mkimg -f vmdks

Also, adjust bootstrap tools code in Makefile.inc1 to reflect this; in
addition to rebuilding mkimg if it is out of date, we now need to build
libz, which was not previously needed by mkimg.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60153
X-Cherry-Pick:  Logic in Makefile.inc1 was adjusted for new __FreeBSD_version

(cherry picked from commit a68ba2d2ce55f7c76174239c1f678379caec5348)
DeltaFile
+5-3Makefile.inc1
+1-1sys/sys/param.h
+6-42 files

HardenedBSD/src bce513d — usr.bin/mkimg/tests img-63x255-4096-mbr.vmdks.hex img-63x255-4096-ebr.vmdks.hex

mkimg: Add tests for vmdks format

This is the 'stream-optimized' version of the VMDK format.

MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60154

(cherry picked from commit 65b872380ed7f7900fc581d482c5586eeca9e184)
DeltaFile
+617-0usr.bin/mkimg/tests/img-1x1-512-gpt.vmdks.hex
+617-0usr.bin/mkimg/tests/img-1x1-4096-gpt.vmdks.hex
+617-0usr.bin/mkimg/tests/img-63x255-512-gpt.vmdks.hex
+617-0usr.bin/mkimg/tests/img-63x255-4096-gpt.vmdks.hex
+596-0usr.bin/mkimg/tests/img-63x255-4096-mbr.vmdks.hex
+596-0usr.bin/mkimg/tests/img-63x255-4096-ebr.vmdks.hex
+3,660-015 files not shown
+11,963-121 files

HardenedBSD/src 3720eae — release Makefile.ec2

EC2: Pass --vmdk to bsdec2-image-upload if needed

Starting with version 1.5.0, bsdec2-image-upload supports uploading
stream-optimized VMDK files.  If we build images in that format, we
need to upload them appropriately.

MFC after:      2 weeks
Sponsored by:   Amazon

(cherry picked from commit 65840afc88553f89c051b96b081061a532cb7df3)
DeltaFile
+4-1release/Makefile.ec2
+4-11 files

HardenedBSD/src 646efd6 — usr.bin/mkimg vmdk.c

mkimg: Make vmdk's desc_fmt slightly more generic

This will allow it to be reused in upcoming work.

Suggested by:   Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60150

(cherry picked from commit 498276b487c838afa2b3e4df322c43141788ba20)
DeltaFile
+6-3usr.bin/mkimg/vmdk.c
+6-31 files

HardenedBSD/src 4e9d2e7 — usr.bin/mkimg vmdk.c

mkimg: Check for realloc failure

If realloc fails, clean up and return ENOMEM; don't just copy data
into NULL.

Reviewed by:    emaste
Reported by:    Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60147

(cherry picked from commit 1a0523197c5c16ce7bcb79d16c6bf8945258b428)
DeltaFile
+6-1usr.bin/mkimg/vmdk.c
+6-11 files

HardenedBSD/src 207d505 — usr.bin/mkimg image.h image.c

mkimg: Add image_buffer_region

This is like image_copyout_region, but copies into a buffer rather than
writing out to a file; it will be used by future support for compressed
images (and potentially other circumstances where image data must be
manipulated before being written out to disk).

Reviewed by:    jrm
No objection from:      Christos Komis (author)
MFC after:      2 weeks
Sponsored by:   Google LLC (GSoC 2025)
Differential Revision:  https://reviews.freebsd.org/D60149

(cherry picked from commit 84a3e29c72030dab16b4dc82d601d0af5da6a18c)
DeltaFile
+68-0usr.bin/mkimg/image.c
+1-0usr.bin/mkimg/image.h
+69-02 files

HardenedBSD/src dad0a37 — usr.bin/mkimg mkimg.1

mkimg.1: Document new vmdks format

Reviewed by:    ziaee
Co-authored-by: Claude Opus 5.5
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60152

(cherry picked from commit 88017d32745ef24d662db826fe475d8a20d290a6)
DeltaFile
+12-2usr.bin/mkimg/mkimg.1
+12-21 files

HardenedBSD/src 2c085d5 — usr.bin/mkimg image.c

mkimg: Avoid leaking a page of mmap

The image_file_map function adjusts the provided file offset to be
page-aligned, with a resulting increase in the size of the mapped
region; the increased size needs to be used when unmapping as well.

Reported by:    Claude Opus 5.5
Fixes:  baf4abfc39b2 ("Allow building mkimg as cross-tool")
MFC after:      2 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60148

(cherry picked from commit 434819b4fec5e508bdfe72f91e73402e9c2fca22)
DeltaFile
+5-4usr.bin/mkimg/image.c
+5-41 files

HardenedBSD/src 94deb9c — usr.bin/mkimg Makefile vmdk.c

mkimg: Add support for stream-optimized VMDK

FreeBSD VM/cloud images tend to be highly compressible: The generic VM
images compress roughly 3.5:1, and cloud images typically even more
since they have significant unused space in their virtual disks.  This
generally doesn't matter for users who can download compressed release
images and extract them locally, but for EC2 in particular relying on
uncompressed image formats is painful: We now upload over 500 GB/week
to AWS.

This commit adds the "stream-optimized" version of the VMDK format,
which compresses each 64 kB "grain" individually (and omits grains
which are all zeroes).  Compared to uncompressed formats, this can
produce much smaller images; experiments indicate that using this
format for EC2 image uploads will reduce the weekly traffic to under
100 GB/week.

Co-authored-by: Claude Opus 5.5
MFC after:      2 weeks

    [4 lines not shown]
DeltaFile
+309-0usr.bin/mkimg/vmdk.c
+1-1usr.bin/mkimg/Makefile
+310-12 files

HardenedBSD/src a8be899 — . Makefile.inc1, release Makefile Makefile.inc1

build: Support got

Add code for using got(1), matching how git(1) is currently used:
1. Determining the git branch,
2. Determining the checked-out hash,
3. Determining the commit count,
4. Determining the timestamp of the most recent commit,
5. Determining if the tree is "dirty",
6. Generating lists of files for the src and src-sys packages, and
7. Excluding .got directories from src.txz and ports.txz.

The release engineer hopes to use this functionality in release builds,
since got's minimalism makes it a far more manageable build tool than
git.

Reviewed by:    naddy
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60606
DeltaFile
+33-2sys/conf/newvers.sh
+31-0Makefile.inc1
+27-1release/Makefile.inc1
+2-2release/Makefile
+93-54 files

HardenedBSD/src c54ffb0 — .github/workflows cross-bootstrap-tools.yml

.github: Update to use llvm 15

This is the latest supported version in Ubuntu 22.04

Reviewed by:    vexeduxr, imp, emaste
Sponsored by:   Arm Ltd
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1862

(cherry picked from commit cf583997282f962d9e8bf478667d5087f7c1f2da)
DeltaFile
+3-3.github/workflows/cross-bootstrap-tools.yml
+3-31 files

HardenedBSD/src 19a5023 — .github/workflows checklist.yml

github: Only run the checklist checker for PRs against main

Currently this check is run on every push to stable branches which all
fail since they fail to fetch the non-existent .github/path-rules.txt
from the just-updated branches.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D60709
DeltaFile
+1-0.github/workflows/checklist.yml
+1-01 files

HardenedBSD/src e74ab99 — sys/compat/linuxkpi/common/include/linux rwlock.h mutex.h, sys/conf options

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+1-28sys/compat/linuxkpi/common/include/linux/kconfig.h
+3-5sys/compat/linuxkpi/common/include/linux/spinlock.h
+2-4sys/compat/linuxkpi/common/include/linux/kernel.h
+2-2sys/compat/linuxkpi/common/include/linux/mutex.h
+0-3sys/conf/options
+1-1sys/compat/linuxkpi/common/include/linux/rwlock.h
+9-439 files not shown
+15-5215 files

HardenedBSD/src 4d7637a — contrib/llvm-project/compiler-rt/lib/asan asan_malloc_win.cpp asan_allocator.h, contrib/llvm-project/compiler-rt/lib/hwasan hwasan_allocation_functions.cpp

Merge remote-tracking branch 'rad/hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+108-8contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp
+32-32contrib/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp
+32-0contrib/llvm-project/compiler-rt/lib/hwasan/hwasan_allocation_functions.cpp
+26-4contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp
+22-5contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.h
+5-5contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp
+225-543 files not shown
+231-639 files

HardenedBSD/src 3d086e1 — sys/compat/linuxkpi/common/include/linux rwlock.h mutex.h, sys/conf options

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+1-28sys/compat/linuxkpi/common/include/linux/kconfig.h
+3-5sys/compat/linuxkpi/common/include/linux/spinlock.h
+2-4sys/compat/linuxkpi/common/include/linux/kernel.h
+2-2sys/compat/linuxkpi/common/include/linux/mutex.h
+0-3sys/conf/options
+1-1sys/compat/linuxkpi/common/include/linux/rwlock.h
+9-439 files not shown
+15-5215 files

HardenedBSD/src d7a704e — contrib/llvm-project/compiler-rt/lib/asan asan_malloc_win.cpp asan_allocator.h, contrib/llvm-project/compiler-rt/lib/hwasan hwasan_allocation_functions.cpp

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+108-8contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp
+32-32contrib/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp
+32-0contrib/llvm-project/compiler-rt/lib/hwasan/hwasan_allocation_functions.cpp
+26-4contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp
+22-5contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.h
+5-5contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp
+225-543 files not shown
+231-639 files

HardenedBSD/src 4192a88 — contrib/llvm-project/compiler-rt/lib/asan asan_malloc_mac.cpp asan_malloc_linux.cpp

Merge commit 681c2ee4dfbf from llvm-project (by Justin King):

  asan: refactor interceptor allocation/deallocation functions (#145087)

  Do some refactoring to allocation/deallocation interceptors. Expose
  explicit per-alloc_type functions and stop accepting explicit AllocType.
  This ensures we do not accidentally mix.

  NOTE: This change rejects attempts to call `operator new(<some_size>,
  static_cast<std::align_val_t>(0))`.

  For https://github.com/llvm/llvm-project/issues/144435

  Signed-off-by: Justin King <jcking at google.com>

This a prerequisite for adding sanitizer interceptors for free_sized(3)
and free_aligned_sized(3).

PR:             298943

    [3 lines not shown]
DeltaFile
+97-10contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp
+32-32contrib/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp
+19-5contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.h
+5-5contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp
+4-4contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp
+3-3contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_mac.cpp
+160-591 files not shown
+161-607 files

HardenedBSD/src d526521 — contrib/llvm-project/compiler-rt/lib/asan asan_allocator.h asan_allocator.cpp, contrib/llvm-project/compiler-rt/lib/hwasan hwasan_allocation_functions.cpp

Merge commit a5fa4dba6e2e from llvm-project (by PiJoules):

  [compiler-rt] Add interceptors for free_[aligned_]sized for asan+hwasan (#189109)

This avoids a jemalloc assertion when running sanitized applications
against glib, which uses free_sized(3).

PR:             298943
MFC after:      1 week

(cherry picked from commit a3fbf20c0558ee3c2b88adc0c944e66d074cab7b)
DeltaFile
+32-0contrib/llvm-project/compiler-rt/lib/hwasan/hwasan_allocation_functions.cpp
+22-0contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp
+13-0contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp
+3-0contrib/llvm-project/compiler-rt/lib/asan/asan_allocator.h
+70-04 files

HardenedBSD/src 37eb7f2 — contrib/llvm-project/compiler-rt/lib/sanitizer_common sanitizer_internal_defs.h

compiler-rt: enable use of .preinit_array after ef758b59a44e

After base ef758b59a44e6b5b2d2dc178b97c01cde1b34570 we can enable usage
of .preinit_array in compiler-rt's sanitizers. The comment that stated
"On FreeBSD, .preinit_array functions are called with rtld_bind_lock
writer lock held. It will lead to dead lock ..." can also be removed.

PR:             298943
MFC after:      1 week

(cherry picked from commit 000856156745f1a9a05705f8a499c0fd84f183ca)
DeltaFile
+2-5contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h
+2-51 files

HardenedBSD/src 6866177 — sys/compat/linuxkpi/common/include/linux rwlock.h mutex.h, sys/conf options

Revert LinuxKPI: LINUXKPI_DEBUG changes to allow drm-kmod to build

It has been almost a week with an open pull-requests and a follow-up
identified merge from master drm-kmod, as well as a patch supplied
in a PR for the ports to fix the the current build breakage in drm-kmod
and as a result also in nvidia-drm-* ports.

The problem there is that instead of using the kmod.mk supplied
definitions for LINUXKPI and despite using kmod.mk for the build,
the external components have hand-rolled solutions which can get
out of synch with src.git.

This was not discovered early on given that building drm-kmod with
LOCAL_MODULES_DIR= from git sources will not fail as the kernel
build will have provided the new opt_linuxkpi.h file.  In addition
drm-kmod master already had the -include for kconfig.h which the
src tree has had since 2024.

Give the pkgbase/kmod builds and users over the weekend a chance

    [10 lines not shown]
DeltaFile
+1-28sys/compat/linuxkpi/common/include/linux/kconfig.h
+3-5sys/compat/linuxkpi/common/include/linux/spinlock.h
+2-4sys/compat/linuxkpi/common/include/linux/kernel.h
+2-2sys/compat/linuxkpi/common/include/linux/mutex.h
+0-3sys/conf/options
+1-1sys/compat/linuxkpi/common/include/linux/rwlock.h
+9-439 files not shown
+15-5215 files

HardenedBSD/src 33a02b7 — libexec/rtld-elf rtld.c

Merge remote-tracking branch 'rad/hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+5-3libexec/rtld-elf/rtld.c
+5-31 files

HardenedBSD/src ee548f1 — libexec/rtld-elf rtld.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+5-3libexec/rtld-elf/rtld.c
+5-31 files

HardenedBSD/src afea1a2 — libexec/rtld-elf rtld.c

rtld: release rtld_bind_lock around calls to .preinit_array initializers

PR:     298943

(cherry picked from commit ef758b59a44e6b5b2d2dc178b97c01cde1b34570)
DeltaFile
+5-3libexec/rtld-elf/rtld.c
+5-31 files

HardenedBSD/src 5b7ac55 — lib/libsys/x86 sysarch.x86.2, sys/net rtsock.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+659-0lib/libsys/x86/sysarch.x86.2
+11-49sys/netpfil/ipfw/ip_fw2.c
+6-38sys/netpfil/ipfw/ip_fw_nat.c
+20-20sys/netinet6/icmp6.c
+4-32sys/netpfil/ipfw/nat64/ip_fw_nat64.c
+17-17sys/net/rtsock.c
+717-15663 files not shown
+946-38169 files

HardenedBSD/src e9937c4 — lib/libsys/x86 sysarch.x86.2, sys/net rtsock.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+659-0lib/libsys/x86/sysarch.x86.2
+11-49sys/netpfil/ipfw/ip_fw2.c
+6-38sys/netpfil/ipfw/ip_fw_nat.c
+20-20sys/netinet6/icmp6.c
+4-32sys/netpfil/ipfw/nat64/ip_fw_nat64.c
+17-17sys/net/rtsock.c
+717-15663 files not shown
+946-38169 files

HardenedBSD/src bdcfeac — lib/libsys sysarch.2, lib/libsys/x86 Makefile.sys sysarch.x86.2

sysarch.x86.2: manual page for the sysarch(2) functions on x86

Reviewed by:    ziaee
Discussed with: jhb
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D60047
DeltaFile
+659-0lib/libsys/x86/sysarch.x86.2
+2-1lib/libsys/x86/Makefile.sys
+2-1lib/libsys/sysarch.2
+663-23 files

HardenedBSD/src bfb7ee5 — usr.sbin/tcpsso tcpsso.8

tcpsso.8: fix a cosmetic nit and make mandoc -Tlint happy
DeltaFile
+1-1usr.sbin/tcpsso/tcpsso.8
+1-11 files

HardenedBSD/src c7cf285 — usr.sbin/tcpsso tcpsso.c

tcpsso: fix the level error messages

tcpsso incorrectly referred to the optname instead of
the level name/number.

MFC after:      2 weeks
DeltaFile
+3-3usr.sbin/tcpsso/tcpsso.c
+3-31 files

HardenedBSD/src d7cf2e7 — sys/net if_bridge.c rtsock.c, sys/netinet ip_icmp.c tcp_subr.c

net*: remove remnants of caddr_t

caddr_t is a typedef for a character pointer (char *) that originated in
Version 7 Unix, released by AT&T in 1979.  It became obsolete in 1989,
when ANSI C introduced void *.

What's left:

* ioctl(9) KPI still uses caddr_t, thus network related ioctl method
  still use it.
* if_clone KPI, to be done separately.
* bpf(4), to be done separately.
* SCTP, let maintainers decide.
* iflib(4), let maintainers decide.

Reviewed by:            zlei
Differential Revision:  https://reviews.freebsd.org/D60738
DeltaFile
+20-20sys/netinet6/icmp6.c
+17-17sys/net/rtsock.c
+15-18sys/netinet/tcp_subr.c
+10-10sys/netinet6/ip6_input.c
+8-9sys/netinet/ip_icmp.c
+8-8sys/net/if_bridge.c
+78-8246 files not shown
+202-20452 files