HardenedBSD/src 92450d2sys/arm64/arm64 vfp.c, sys/dev/ixgbe if_ix.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+19-4sys/dev/ixgbe/if_ix.c
+3-4sys/arm64/arm64/vfp.c
+22-82 files

HardenedBSD/src 6c20a03sys/arm64/arm64 vfp.c, sys/dev/ixgbe if_ix.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+19-4sys/dev/ixgbe/if_ix.c
+3-4sys/arm64/arm64/vfp.c
+22-82 files

HardenedBSD/src c103eabusr.sbin/pmcstat pmcstat.8

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+2-2usr.sbin/pmcstat/pmcstat.8
+2-21 files

HardenedBSD/src 3f3f452usr.sbin/pmcstat pmcstat.8

pmcstat.8: Add a missing ERRORS section header

MFC after:      3 days
Sponsored by:   fme AG

(cherry picked from commit 5729a0b45cd1a24c8b82d161de4711b4e004498d)
DeltaFile
+2-2usr.sbin/pmcstat/pmcstat.8
+2-21 files

HardenedBSD/src 33e2eacsys/dev/ixgbe if_ix.c

ix(4): Sanitize negative error codes

Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>

Reviewed by:    kbowling, erj, milosz.linkiewicz_intel.com
Tested by:      Mateusz Moga <mateusz.moga at intel.com>
MFC after:      1 week
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D57642
DeltaFile
+19-4sys/dev/ixgbe/if_ix.c
+19-41 files

HardenedBSD/src 189ee41sys/arm64/arm64 vfp.c

arm64 vfp: eliminate nested critical sections

At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable().  So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().

Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58859
DeltaFile
+3-4sys/arm64/arm64/vfp.c
+3-41 files

HardenedBSD/src c303c5elib/libc/gen fts.3 fts.c, lib/libc/tests/gen fts_openat_test.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+250-0lib/libc/tests/gen/fts_openat_test.c
+28-70sys/dev/ufshci/ufshci_dev.c
+57-11lib/libc/gen/fts.c
+44-0sys/dev/ice/if_ice_iflib.c
+22-20sys/dev/ufshci/ufshci_req_sdb.c
+33-1lib/libc/gen/fts.3
+434-1029 files not shown
+485-12015 files

HardenedBSD/src 4404675lib/libc/gen fts.3 fts.c, lib/libc/tests/gen fts_openat_test.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+250-0lib/libc/tests/gen/fts_openat_test.c
+28-70sys/dev/ufshci/ufshci_dev.c
+57-11lib/libc/gen/fts.c
+44-0sys/dev/ice/if_ice_iflib.c
+22-20sys/dev/ufshci/ufshci_req_sdb.c
+33-1lib/libc/gen/fts.3
+434-1029 files not shown
+485-12015 files

HardenedBSD/src 29dea9acontrib/less search.c command.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40243 files not shown
+1,926-76649 files

HardenedBSD/src 68091ebsys/dev/ufshci ufshci_sim.c

ufshci: report the highest LUN number in the path inquiry

cpi->max_lun is an inclusive upper bound, but the driver reported the
LUN count (8 or 32), so CAM probed one nonexistent LUN past the end.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58820
DeltaFile
+1-1sys/dev/ufshci/ufshci_sim.c
+1-11 files

HardenedBSD/src 3451829sys/dev/ufshci ufshci_reg.h

ufshci: correct the crypto/config register offsets and HCMID fields

The reserved array after CCAP must be 508, but it was 511.
This pushed the config, MCQ config, and ESI registers from 0x300 and
0x380 up to 0x900. None of these registers are used yet, so nothing
broke.

Also fix the HCMID bank index field. The spec places it at bits
[23:16], but it was defined on top of the manufacturer code at [15:0].

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58819
DeltaFile
+20-3sys/dev/ufshci/ufshci_reg.h
+20-31 files

HardenedBSD/src e1aa173sys/dev/ufshci ufshci_dev.c

ufshci: consolidate the device query submit/poll pattern

The six query helpers duplicated the same submit, error check, poll,
and status check sequence. Move it into ufshci_dev_send_query() so
future changes to the query flow are made in one place. This also
unifies the failure log message format.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58818
DeltaFile
+28-70sys/dev/ufshci/ufshci_dev.c
+28-701 files

HardenedBSD/src f3c3db3sys/dev/ufshci ufshci_sim.c

ufshci: validate the CDB before allocating a request

The CDB pointer and length checks depend only on the CCB, so perform
them before allocating and initializing the request. This avoids a
wasted allocation for invalid CCBs on the I/O path and removes one
request-free error path.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58817
DeltaFile
+11-11sys/dev/ufshci/ufshci_sim.c
+11-111 files

HardenedBSD/src dbcebc7sys/dev/ufshci ufshci_req_sdb.c

ufshci: pass the queue being destroyed to the cmd descriptor teardown

ufshci_req_sdb_destroy() hardcoded &ctrlr->transfer_req_queue when
destroying command descriptors instead of using its req_queue argument.

No functional change: the branch only runs for the transfer queue, so
the two pointers are always the same today. Using the argument keeps
the function queue-agnostic for when more transfer queues exist (MCQ).

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58816
DeltaFile
+1-2sys/dev/ufshci/ufshci_req_sdb.c
+1-21 files

HardenedBSD/src a508a9fsys/dev/ufshci ufshci_req_sdb.c

ufshci: return the real errno from SDB queue construction

ufshci_req_sdb_cmd_desc_construct() and ufshci_req_sdb_construct()
returned ENOMEM for every failure, so an EINVAL from bus_dma_tag_create()
was reported as a memory shortage. Capture and return the real errno,
and drop the cmd descriptor construct's now pointless out label.

No functional change: no caller inspects the value beyond propagating
it, so this only improves the diagnostics on an attach failure.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58815
DeltaFile
+21-18sys/dev/ufshci/ufshci_req_sdb.c
+21-181 files

HardenedBSD/src c620652contrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files

HardenedBSD/src 6000eb7sys/dev/e1000 e1000_defines.h e1000_ich8lan.c

e1000: Disable autonomous PCH power gating after reset

Panther Point changed the reset value of CTRL_EXT.DPG_EN to enable
autonomous power gating. Clear it after hardware reset on Panther Point
and Nova Point controllers to prevent unexpected Tx/Rx hangs, packet
loss, or corruption.

(cherry picked from commit 0979b0430c2d728e595841ecba30b63972794fe9)
DeltaFile
+8-0sys/dev/e1000/e1000_ich8lan.c
+1-0sys/dev/e1000/e1000_defines.h
+9-02 files

HardenedBSD/src 508a232sys/dev/ice ice_drv_info.h

ice(4): Add support for E835 CNSA 2.0 adapters

Added support for E835 adapters with post-quantum cryptographic (PQC)
algorithms in firmware/software signage and in SPDM attestation.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>

Reviewed by:    Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Differential Revision:  https://reviews.freebsd.org/D57868

(cherry picked from commit 8194c32827e9c3867d4b295edca9842b71608526)
DeltaFile
+30-0sys/dev/ice/ice_drv_info.h
+30-01 files

HardenedBSD/src af06940share/man/man4 bnxt.4

bnxt(4): Cross-reference led(4)

Point the identification LED documentation to led(4), which describes
how to control /dev/led device nodes.

MFC after:      2 weeks
Sponsored by:   BBOX.io
DeltaFile
+4-1share/man/man4/bnxt.4
+4-11 files

HardenedBSD/src a781965share/man/man4 ice.4, sys/dev/ice ice_iflib.h if_ice_iflib.c

ice: Add led(4) identification support

Expose the firmware-controlled physical port identification LED
through /dev/led/ice*.  Use the AdminQ port-identification command to
select blinking mode and restore the netlist-selected original mode
before the interface is stopped.

MFC after:      2 weeks
Sponsored by:   BBOX.io
DeltaFile
+44-0sys/dev/ice/if_ice_iflib.c
+8-1share/man/man4/ice.4
+1-0sys/dev/ice/ice_iflib.h
+53-13 files

HardenedBSD/src a43b61ausr.sbin/makefs/tests makefs_zfs_tests.sh, usr.sbin/makefs/zfs dsl.c

makefs: Allow "legacy" as a valid ZFS mountpoint

Allow "legacy" alongside "none" as a valid value for the ZFS mountpoint
property, matching zfsprops(7).

Reviewed by:    imp, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58781

(cherry picked from commit 59d6422d6f21fd5cf4709ce9fcada54d3925a4f6)
DeltaFile
+39-0usr.sbin/makefs/tests/makefs_zfs_tests.sh
+3-2usr.sbin/makefs/zfs/dsl.c
+42-22 files

HardenedBSD/src 886de9eusr.sbin/makefs/tests makefs_zfs_tests.sh

makefs: tests: Fix a missing slash in multi_dataset_4

Fix a typo in the ZFS multi_dataset_4 test, where a path separator was
missing.

Reported by:    markj
MFC after:      1 week

(cherry picked from commit 889d08f6b61da4724a6f718be7ec8d47824bc602)
DeltaFile
+1-1usr.sbin/makefs/tests/makefs_zfs_tests.sh
+1-11 files

HardenedBSD/src 9aed7a7include fts.h, lib/libc/gen Symbol.map Makefile.inc

fts: add fts_openat() API

Add fts_openat() as a new entry point for fts(3).

When dirfd is AT_FDCWD the behaviour is identical to fts_open().
Passing a pre-opened directory fd allows fts traversal inside
Capsicum capability mode where path-based operations are not
permitted.

Capability mode users should use fts_parent->fts_dirfd + fts_name with
openat(2) to access files.

Reviewed by:    asomers
Relnotes:       yes
Sponsored by:   Google LLC (GSoC 2026)
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2273
DeltaFile
+250-0lib/libc/tests/gen/fts_openat_test.c
+57-11lib/libc/gen/fts.c
+33-1lib/libc/gen/fts.3
+3-1include/fts.h
+1-0lib/libc/gen/Symbol.map
+1-0lib/libc/gen/Makefile.inc
+345-131 files not shown
+346-137 files

HardenedBSD/src 1af39cfinclude stdckdint.h, lib/libc/gen fts.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+66-0lib/libc/tests/gen/fts_misc_test.c
+47-0sys/sys/ckdint.h
+2-24include/stdckdint.h
+7-5sys/kern/kern_malloc.c
+1-1sbin/restore/symtab.c
+2-0lib/libc/gen/fts.c
+125-304 files not shown
+129-3310 files

HardenedBSD/src 93cbfe9include stdckdint.h, lib/libc/gen fts.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+66-0lib/libc/tests/gen/fts_misc_test.c
+47-0sys/sys/ckdint.h
+2-24include/stdckdint.h
+7-5sys/kern/kern_malloc.c
+1-1sbin/restore/symtab.c
+2-0lib/libc/gen/fts.c
+125-304 files not shown
+129-3310 files

HardenedBSD/src 9b8c2bflib/libc/gen fts.c, lib/libc/tests/gen fts_misc_test.c

fts: fix file descriptor leak in fts_close

fts_build() stores a dup'd file descriptor in each directory
entry's fts_dirfd.  When a traversal is abandoned before
completion and fts_close() is called, the cleanup loop freed
each pending entry with free() without first closing its
fts_dirfd, leaking one descriptor per pending directory.

Close fts_dirfd before freeing each entry in the cleanup loop,
matching the handling already applied to the dummy parent entry
after the loop.

Add a regression test that descends a couple of levels, abandons
the traversal, closes, and asserts the open descriptor count is
unchanged.

PR:             297557
Reported by:    asomers
Fixes:          4bd01d6ae016

    [3 lines not shown]
DeltaFile
+66-0lib/libc/tests/gen/fts_misc_test.c
+2-0lib/libc/gen/fts.c
+68-02 files

HardenedBSD/src a77edebsys/geom/eli g_eli.c, sys/kern subr_hints.c kern_environment.c

SYSINIT: add SI_SUB_KENV

Since the kernel environment has its own dependencies, lurking at the end
of the SI_SUB_KMEM sequence appeared to be fragile.  Provide own subsystem
for it.  The init_dynamic_kenv() goes SI_ORDER_FIRST, and two modules that
depend on it go SI_ORDER_ANY.

PR:                     297492
Reviewed by:            imp, markj, emaste
Differential Revision:  https://reviews.freebsd.org/D58836
DeltaFile
+1-1sys/kern/subr_hints.c
+1-1sys/kern/kern_environment.c
+1-1sys/geom/eli/g_eli.c
+1-0sys/sys/kernel.h
+4-34 files

HardenedBSD/src 2cefae4sbin/restore symtab.c

Fix transposed arguments in call to calloc(). Reported by GCC 15 warning.

No functional change intended.

Submitted by: Pedro Giffuni <pfg at freebsd.org>
MFC-after:    1 week
DeltaFile
+1-1sbin/restore/symtab.c
+1-11 files

HardenedBSD/src 37bd69dinclude stdckdint.h, sys/sys ckdint.h

sys: Add sys/ckdint.h

We have a C23 stdckdint.h header for userspace, which provides checked
addition, subtraction and multiplication.  We lack similar helpers in
the kernel, where they are regularly needed.

Let's just adopt the C23 macros.  For bonus points, I added a wrapper to
ensure that ignored an return value is raised as an error by the
compiler.

Reviewed by:    kib, emaste
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58773
DeltaFile
+47-0sys/sys/ckdint.h
+2-24include/stdckdint.h
+49-242 files

HardenedBSD/src 2d67765sys/kern kern_malloc.c

malloc: Use ckdint.h helpers instead of WOULD_OVERFLOW

This serves to demonstrate some usage of the ckdint.h helpers.  The new
version also generates better machine code on amd64 and arm64.

Reviewed by:    kib, emaste
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
DeltaFile
+7-5sys/kern/kern_malloc.c
+7-51 files