HardenedBSD/src 6ea32d0share/man/man5 src.conf.5, share/mk src.opts.mk

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+107-29sys/dev/usb/input/ukbd.c
+105-30sys/dev/hid/hkbd.c
+18-1share/man/man5/src.conf.5
+8-3sys/dev/evdev/evdev_utils.c
+8-0share/mk/src.opts.mk
+2-5sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
+248-687 files not shown
+259-7213 files

HardenedBSD/src 157cf79share/man/man5 src.conf.5, share/mk src.opts.mk

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+107-29sys/dev/usb/input/ukbd.c
+105-30sys/dev/hid/hkbd.c
+18-1share/man/man5/src.conf.5
+8-3sys/dev/evdev/evdev_utils.c
+8-0share/mk/src.opts.mk
+2-5sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
+248-687 files not shown
+259-7213 files

HardenedBSD/src 0d9676eshare/man/man5 src.conf.5, share/mk src.opts.mk

mk: Disable blacklist when disabling blocklist

WITHOUT_BLOCKLIST, when set, should enforce WITHOUT_BLACKLIST.
This fixes the build when WITHOUT_BLOCKLIST=yes is set.

Reported by:    ivy
Reviewed by:    ivy
Fixes:          7238317403b9 ("blocklist: Rename blacklist to blocklist")
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56118
DeltaFile
+18-1share/man/man5/src.conf.5
+8-0share/mk/src.opts.mk
+26-12 files

HardenedBSD/src 4f0d0edlibexec Makefile

libexec: Add pkg-serve directory

Add pkg-serve to the list of subdirectories in the Makefile.

Reviewed by:    bapt
Fixes:          b42e852e89cb ("pkg-serve(8): serve pkg repositories over TCP via inetd (8)")
Differential Revision:  https://reviews.freebsd.org/D56009
DeltaFile
+1-0libexec/Makefile
+1-01 files

HardenedBSD/src 920ad3csys/dev/usb/input ukbd.c

ukbd(4): make debug guard consistent with hkbd(4)

Signed-off-by: Toby Slight <tslight at pm.me>

Reviewed by:    wulf
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1998
DeltaFile
+3-1sys/dev/usb/input/ukbd.c
+3-11 files

HardenedBSD/src bb8230fsys/dev/hid hkbd.c, sys/dev/usb/input ukbd.c

hkbd(4): add some extra handy fn key bindings

- Fn+S for ScrollLock as it's very useful to have ScrollLock on
  FreeBSD's TTY.
- Fn+P for PrtSc/SysRq, as it's another very handy but sadly missing
  key on Macbooks.
- Some other Fn+<key> combinations duplicating existing keys.

Apply the change to ukbd(4) as well.

Signed-off-by: Toby Slight <tslight at pm.me>

Reviewed by:    wulf
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1998
DeltaFile
+10-0sys/dev/hid/hkbd.c
+10-0sys/dev/usb/input/ukbd.c
+20-02 files

HardenedBSD/src 1033253sys/dev/hid hkbd.c, sys/dev/usb/input ukbd.c

hkbd(4): be more cautious & explicit about Apple vendor checking

Apply the changes to ukbd(4) as well.

Signed-off-by: tslight <tslight at pm.com>

Reviewed by:    wulf
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1998
DeltaFile
+34-29sys/dev/hid/hkbd.c
+31-26sys/dev/usb/input/ukbd.c
+1-1sys/modules/hid/hkbd/Makefile
+66-563 files

HardenedBSD/src 40f55easys/dev/hid hkbd.c, sys/dev/usb/input ukbd.c

ukbd(4): backport Apple function keys support from hkbd(4)

and expose eject in addition to fn.

Signed-off-by: tslight <tslight at pm.com>

Reviewed by:    wulf
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1998
DeltaFile
+81-20sys/dev/usb/input/ukbd.c
+10-6sys/dev/hid/hkbd.c
+91-262 files

HardenedBSD/src f54caa0sys/dev/evdev evdev_utils.c, sys/dev/hid hkbd.c hid.h

hkbd(4): fix handling of apple function keys in hid and evdev

Signed-off-by: tslight <tslight at pm.com>

Reviewed by:    wulf
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1998
DeltaFile
+72-16sys/dev/hid/hkbd.c
+8-3sys/dev/evdev/evdev_utils.c
+2-0sys/dev/hid/hid.h
+82-193 files

HardenedBSD/src d82bcf5sys/netgraph/bluetooth/drivers/ubt ng_ubt.c ng_ubt_intel.c, usr.sbin/bluetooth/iwmbtfw iwmbtfw.8 iwmbtfw.conf

bluetooth: add device IDs for Intel AX411 and BE200 adapters

Add USB product IDs for Intel AX411 (0x0035) and BE200 (0x0036)
Bluetooth adapters to ng_ubt_intel, ng_ubt, iwmbtfw, and iwmbtfw.conf.

Both chips use the same TLV-based firmware protocol as the existing
9260/9560 entries.  Newer Blazar-generation chips (BE201, BE202,
Whale Peak 2) are omitted as they require IML support not yet
implemented in iwmbtfw.

Signed-off-by: Christos Longros <chris.longros at gmail.com>

Reviewed by:    wulf
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56122
DeltaFile
+2-5sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
+2-2usr.sbin/bluetooth/iwmbtfw/iwmbtfw.8
+2-0sys/netgraph/bluetooth/drivers/ubt/ng_ubt_intel.c
+1-1usr.sbin/bluetooth/iwmbtfw/iwmbtfw.conf
+2-0usr.sbin/bluetooth/iwmbtfw/main.c
+9-85 files

HardenedBSD/src 39fe758sys/amd64/amd64 exec_machdep.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+28-1sys/amd64/amd64/exec_machdep.c
+28-11 files

HardenedBSD/src 38e0ac0sys/amd64/amd64 exec_machdep.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+28-1sys/amd64/amd64/exec_machdep.c
+28-11 files

HardenedBSD/src 7d1285esys/amd64/amd64 exec_machdep.c

amd64 sendsig(): explicitly copy registers from trapframe to ucontext

With the IDT event delivery, previously reserved fields in tf_cs and
tf_ss are guaranteed to be zero. With FRED, these fields are not zero,
which affects the values copied to userspace.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56141
DeltaFile
+28-1sys/amd64/amd64/exec_machdep.c
+28-11 files

HardenedBSD/src b84418fsys/dev/usb usbdevs, usr.sbin/syslogd syslogd.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-0sys/dev/usb/usbdevs
+1-1usr.sbin/syslogd/syslogd.c
+30-13 files

HardenedBSD/src cda272asys/dev/usb usbdevs, usr.sbin/syslogd syslogd.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-0sys/dev/usb/usbdevs
+1-1usr.sbin/syslogd/syslogd.c
+30-13 files

HardenedBSD/src 6904270usr.sbin/syslogd syslogd.c, usr.sbin/syslogd/tests syslogd_test.sh

syslogd: Fix ereregex property filters and add test

This change fixes Bug 293879, where ereregex filters in syslogd
did not handle alternation correctly.

The issue appears to come from mixing up two different kinds of
flags: syslogd's internal serialized filter flags in
usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
values for configuration serialization and reconstruction.

REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
filter could be reconstructed with the wrong semantics.

The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
correctly REG_EXTENDED when compiling the regex.

A test was also added for both ereregex and !ereregex filters.

    [7 lines not shown]
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+1-1usr.sbin/syslogd/syslogd.c
+23-12 files

HardenedBSD/src e7de7fesys/dev/usb usbdevs

usbdevs: Add USB device IDs for Nuand bladeRF SDR

Add vendor and product IDs for bladeRF family of USB software defined radios manufactured by Nuand LLC.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D54733
DeltaFile
+7-0sys/dev/usb/usbdevs
+7-01 files

HardenedBSD/src 528c683sys/fs/nfsserver nfs_nfsdsocket.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src 77d0196sys/fs/nfsserver nfs_nfsdsocket.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src b65e7b4sys/fs/nfsserver nfs_nfsdsocket.c

nfs_nfsdsocket.c: All Copy and Clone across file systems

For some server file system types, such as ZFS, a Copy/Clone
operation can be done across file systems of the same file
system type.

As such, this patch allows the Copy/Clone to be attempted
when the file handles are for files on different file systems.

This fixes a problem for exported ZFS file systems when a
copy_files on file_range(2) between file systems in the same
NFSv4 mount is attempted.

PR:     294010
MFC after:      2 weeks
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src f2921earelease Makefile, release/scripts HardenedBSD_install_cdrom.conf pkgbase-stage.lua

HBSD: Build framework updates

In preparing the next quarterly build (2026q2), I discovered that
HardenedBSD 15-STABLE is lagging behind with regards to building the
installer images. This commit brings us more up-to-date and fixes the
build.

This is a direct commit to 15-STABLE.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+10-36release/Makefile
+7-11usr.sbin/bsdinstall/scripts/pkgbase.in
+15-0release/scripts/HardenedBSD_install_cdrom.conf
+3-7release/scripts/pkgbase-stage.lua
+4-0release/scripts/HardenedBSD-base-offline.conf
+39-545 files

HardenedBSD/src 30e2162lib/libc/gen dup3.3, lib/libsys dup.2

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-5usr.bin/diff/pr.c
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+10-124 files

HardenedBSD/src 0253f52lib/libc/gen dup3.3, lib/libsys dup.2

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-5usr.bin/diff/pr.c
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+10-124 files

HardenedBSD/src 6cc99balib/libc/gen dup3.3, lib/libsys dup.2

dup(2): document the handling of filedescriptor flags

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D56121
DeltaFile
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+6-12 files

HardenedBSD/src c8d40bfusr.bin/diff pr.c

diff: use O_CLOEXEC on pipes

This only simplifies the code, no functional changes expected

MFC After:      1 week
DeltaFile
+2-5usr.bin/diff/pr.c
+2-51 files

HardenedBSD/src 945e60eusr.bin/diff3 diff3.c

diff3: set O_CLOEXEC on pipes

This avoid leaking pipe fd in children and simplifies the code

MFC After:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56120
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-61 files

HardenedBSD/src 2bcf220sys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/src 01d69basys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/src 7b6be00sys/dev/hyperv/vmbus/x86 hyperv_reg.h, sys/x86/x86 local_apic.c

Hyper-V: Detect Extended Destination ID support

Hyper-V advertises support for the Extended Destination ID standard via
bit 2 of the value returned in the EAX register when the hypervisor
stack properties are queried via CPUID.

This is based on a commit to the Linux kernel, as there does not seem
to be any other documentation of this feature.

Reviewed by:    Souradeep Chakrabarti
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55432
DeltaFile
+9-0sys/x86/x86/local_apic.c
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+15-02 files

HardenedBSD/src 8dd9a0dsys/x86/x86 local_apic.c

Bhyve: Detect Extended Destination ID support

Bhyve advertises support for the Extended Destination ID standard via
bit 0 (aka CPUID_BHYVE_FEAT_EXT_DEST_ID) of the value returned in the
EAX register when Bhyve features are queried via CPUID.

MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55431
DeltaFile
+8-0sys/x86/x86/local_apic.c
+8-01 files