Changes in options

e1cff854997884ed9b7251d409d9c9c7a025606d - pass(4): Allowlist CCB func_codes to harden passthrough ioctls

Fri, 24 Apr 2026 20:29:53 +0200

pass(4): Allowlist CCB func_codes to harden passthrough ioctlsThe pass(4) driver's CAMIOCOMMAND and CAMIOQUEUE ioctls accept arbitraryCCBs from userland. This device requires root to open, and thus sendthese commands. Previously, the only func_code filter was a blocklistcheck against the XPT_FC_XPT_ONLY flag. This missed several dangerousfunc_codes that lack that flag: - XPT_ABORT: the abort_ccb field is a raw kernel pointer from the user CCB payload. xpt_action_default() dereferences it without validation, leading to kernel crashes or worse. - XPT_SASYNC_CB: the callback and callback_arg fields come directly from the user CCB payload and get registered as a kernel async callback, allowing arbitrary kernel code execution. - Target mode CCBs (XPT_EN_LUN, XPT_TARGET_IO, etc.) fall through directly to the SIM with user-controlled payloads.Replace the XPT_FC_XPT_ONLY blocklist with an explicit allowlist of CCBfunction codes that are known to be safe for userland to submit: I/Ooperations (SCSI, ATA, NVMe, SMP, MMC), device queries, transportsettings, and a handful of safe control operations (NOOP, REL_SIMQ,RESET_DEV, DEBUG). Normally, the /dev/pass* permissions only allow rootto access them, so this is only a safety issue by default.Also reject CAM_DATA_PADDR and CAM_DATA_SG_PADDR, since these passuser-supplied physical addresses directly to DMA with no validation,which on systems without an IOMMU allows arbitrary host memory access.Add `options PASS_UNSAFE_PADDR` to allow the old behavior.Verified that camdd, camcontrol, smartmontools, and cdrtools use onlyfunc_codes on the allowlist (XPT_SCSI_IO, XPT_ATA_IO, XPT_NVME_IO,XPT_NVME_ADMIN, XPT_PATH_INQ, XPT_GDEV_TYPE, XPT_GET_TRAN_SETTINGS,XPT_SET_TRAN_SETTINGS, XPT_RESET_DEV, XPT_DEBUG) and none useCAM_DATA_PADDR.PR: 293888, 293890Assisted-By: Claude Opus 4.6 (1M context)Sponsored by: NetflixReviewed by: jhbDifferential Revision: https://reviews.freebsd.org/D56486 List of files: /freebsd/sys/conf/options

a338f5a0e7b1b5c22595aacbac44582ed5e0fe86 - conf: remove trailing whitespace

Mon, 20 Apr 2026 05:08:01 +0200

conf: remove trailing whitespaceThis prevents unwanted change when saving files on IDEs (e.g. VSCode,Zed)Signed-off-by: Minsoo Choo Sponsored by: The FreeBSD FoundationPull request: https://github.com/freebsd/freebsd-src/pull/2152 List of files: /freebsd/sys/conf/options

87bea33a67cad31661a6fb9ea4c62a5fc266cd98 - nd6: Remove DRAFT_IETF_6MAN_IPV6ONLY_FLAG and EXPERIMENTAL options

Thu, 02 Apr 2026 22:01:55 +0200

nd6: Remove DRAFT_IETF_6MAN_IPV6ONLY_FLAG and EXPERIMENTAL optionsThe draft-ietf-6man-ipv6only-flag has been obsoleted by RFC 8925.Remove the EXPERIMENTAL compile option from the kernel and removeDRAFT_IETF_6MAN_IPV6ONLY_FLAG from userland.This compile option was not enabled by default.Also regenerate src.conf.5.Reviewed by: bzDifferential Revision: https://reviews.freebsd.org/D56228 List of files: /freebsd/sys/conf/options

254b23eb1f540844cf2a90f2781ae4231c5701ce - routing: Retire ROUTE_MPATH compile option

Fri, 27 Mar 2026 12:20:05 +0100

routing: Retire ROUTE_MPATH compile optionThe ROUTE_MPATH compile option was introduced totest the new multipath implementation.Since compiling it has no overhead and it's enabledby default, remove it.Reviewed by: melifaro, markjRelnotes: yesDifferential Revision: https://reviews.freebsd.org/D55884 List of files: /freebsd/sys/conf/options

9318336f2af134b26adcb217f78f70bfdcf5f222 - sound: Retire SND_FEEDER_MULTIFORMAT and SND_FEEDER_FULL_MULTIFORMAT

Tue, 24 Mar 2026 11:31:34 +0100

sound: Retire SND_FEEDER_MULTIFORMAT and SND_FEEDER_FULL_MULTIFORMATThere is no reason to have these legacy controls anymore, all theseformats can be handled just fine nowadays.Sponsored by: The FreeBSD FoundationMFC after: 1 weekReviewed by: markjDifferential Revision: https://reviews.freebsd.org/D55937 List of files: /freebsd/sys/conf/options

bf0e5d987ecd2cbec2200e100bad6d6e724e9315 - sound: Retire SND_OLDSTEREO

Tue, 24 Mar 2026 11:31:22 +0100

sound: Retire SND_OLDSTEREOThis is a legacy option and does not serve a good purpose anymore.Sponsored by: The FreeBSD FoundationMFC after: 1 weekReviewed by: markjDifferential Revision: https://reviews.freebsd.org/D55933 List of files: /freebsd/sys/conf/options

5d311c75324a205f3cd8a8a404a25ebdadb18b54 - sound: Retire SND_DEBUG

Tue, 24 Mar 2026 11:31:17 +0100

sound: Retire SND_DEBUGNot useful anymore.Sponsored by: The FreeBSD FoundationMFC after: 1 weekReviewed by: markjDifferential Revision: https://reviews.freebsd.org/D55932 List of files: /freebsd/sys/conf/options

d2dea8b46a8a61359c5185f4af3cc1761139bcb4 - arm: Add EARLY_PRINTF for ns8250 on arm/aarch64 platforms.

Sun, 02 Feb 2025 15:22:34 +0100

arm: Add EARLY_PRINTF for ns8250 on arm/aarch64 platforms.Reviewed by: adrian (previous version)MFC after: 3 weeks List of files: /freebsd/sys/conf/options

87b2c0168d9deb79aacf3f13dbd3201054371b2b - sys/conf/options: remove improper full stops

Fri, 06 Feb 2026 07:03:21 +0100

sys/conf/options: remove improper full stopsOnly keep them when used in a sentence.Reviewed by: vexeduxrSigned-off-by: Quentin Thébault Sponsored by: DefensoCloses: https://github.com/freebsd/freebsd-src/pull/2004 List of files: /freebsd/sys/conf/options

9d015a916745e320aed50fc759f111fc7622e427 - Remove the DEBUG_VFS_LOCKS kernel option

Thu, 15 Jan 2026 14:50:20 +0100

Remove the DEBUG_VFS_LOCKS kernel optionAfter commit 3bd8fab2415b ("vfs: Move DEBUG_VFS_LOCKS checks toINVARIANTS"), this option has no effect. Let's finish the removal.There are a couple of additional uses in zfs, I will submit a separatepatch upstream for them.Reviewed by: mckusick, kibDifferential Revision: https://reviews.freebsd.org/D54662 List of files: /freebsd/sys/conf/options

0ff0c19e7f70bc4d3f98196a8ad43de635cf13e5 - ipfilter: Disable ipfs(8) by default

Sun, 16 Nov 2025 08:39:19 +0100

ipfilter: Disable ipfs(8) by defaultAt the moment ipfs(8) is a tool that can be easily abused. Though theconcept is sound the implementation needs some work.ipfs(8) should be considered experimental at the moment.This commit also makes ipfs support in the kernel optional.Reviewed by: emaste, glebiusMFC after: 1 weekDifferential revision: https://reviews.freebsd.org/D53787 List of files: /freebsd/sys/conf/options

d6f10a5d013fdcc92847644ffbaf65cbf491bb39 - random: allow disabling of entropy harvesting from keyboard & mice

Tue, 28 Oct 2025 03:57:21 +0100

random: allow disabling of entropy harvesting from keyboard & miceReviewed by: jmgSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D53390 List of files: /freebsd/sys/conf/options

3deb21f1afd5c4abfd9cb93ca120097a841536c5 - random: TPM_HARVEST should have been named RANDOM_ENABLE_TPM

Tue, 28 Oct 2025 04:53:43 +0100

random: TPM_HARVEST should have been named RANDOM_ENABLE_TPM* Enable RANDOM_ENABLE_TPM by default* The commit of TPM_HARVEST failed to add it to NOTES so that the LINT kernel would build the code.Fixes: 4ee7d3b0118c82e651712bb65da53d08e78cd7b1Reviewed by: impDifferential Revision: https://reviews.freebsd.org/D53460 List of files: /freebsd/sys/conf/options

685a78570b359eb2bd4d8c28dde22de54d55b8ec - random: remove hifn(4)

Sat, 18 Oct 2025 05:15:50 +0200

random: remove hifn(4)The Hifn 7955 & 7956 only supports deprecated & NIST disallowedalgorithms (NIST SP800-224idp): SHA1 and SHA1-HMAC.Furthermore the entropy RNG of the Hifn 7751, 7951, 7811, 7955,and 7956 has no NIST Entropy Source Validation (ESV) certificateand cannot be used in a FIPS-140-3 nor Common Criteara environment.Furthermore the most prolific instance for FreeBSD was theSoekris Engineering vpn1201, vpn1211, vpn1401, and vpn1411offerings. These are all 32-bit only processors. The i386kernel was de-supported in 15.0.Reviewed by: jhbDifferential Revision: https://reviews.freebsd.org/D53182 List of files: /freebsd/sys/conf/options

bfdd5b643d23171c53920accc2f15f78e984dfae - tcp: improve testing of HPTS

Mon, 13 Oct 2025 22:31:30 +0200

tcp: improve testing of HPTSImprove the HPTS API to allow testing and add several tests.Reviewed by: tuexenSponsored by: Netflix, Inc. List of files: /freebsd/sys/conf/options

e43fbf27976df17991d32c72c41e43fda66fb262 - u2f(4): Invert U2F_MAKE_UHID_ALIAS kernel build option

Thu, 25 Sep 2025 09:54:19 +0200

u2f(4): Invert U2F_MAKE_UHID_ALIAS kernel build optionThis makes non-GENERIC kernel configs easier to maintain.Requested by: glebiusMFC after: 2 days List of files: /freebsd/sys/conf/options

92255335d9451bd425074fab4447799113daf676 - sys: Rename BLOAT_KERNEL_WITH_EXTERR to EXTERR_STRINGS

Tue, 02 Sep 2025 22:58:29 +0200

sys: Rename BLOAT_KERNEL_WITH_EXTERR to EXTERR_STRINGSThere's no need for an implied value judgement.Suggested by: jhbReviewed by: kib, jhbSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D52351 List of files: /freebsd/sys/conf/options

308fa72e5f553966fc6dc3075450d16459cc5c90 - options: remove stale comment

Thu, 21 Aug 2025 18:38:09 +0200

options: remove stale commentFixes: ea916b64125b ("Remove TCP_SAD optional code now that the sack filter performs this function.")Sponsored by: Netflix, Inc. List of files: /freebsd/sys/conf/options

4a04e0a6c703db9d2d9e6a0ef2b000644143b705 - u2f(4): a HID driver for FIDO/U2F security keys

Sun, 17 Aug 2025 23:00:45 +0200

u2f(4): a HID driver for FIDO/U2F security keysWhile FIDO/U2F keys were already supported by the generic uhid(4) andhidraw(4) drivers, this driver adds some additional features an doessteps to tighten the security of FIDO/U2F access.- It automatically loads through devd.- Automatically enables HQ_NO_READAHEAD for FIDO/U2F devices.- Implements only miminum set of features.- Do not requires external devfs configuration to set character device permissions.- Names character device as u2f/# to make possible capsicum or any other pledge()-style sandboxing.PR: 265528Differential Revision: https://reviews.freebsd.org/D51612 List of files: /freebsd/sys/conf/options

df114daef4c48548c3c2b86717612761185ae18f - Import the Hardware Trace (HWT) framework.

Thu, 03 Jul 2025 15:10:45 +0200

Import the Hardware Trace (HWT) framework.The HWT framework provides infrastructure for hardware-assisted tracing. Itcollects detailed information about software execution and records it as"events" in highly compressed format into DRAM. The events cover informationabout control flow changes of a program, whether branches taken or not,exceptions taken, timing information, cycles elapsed and more. This allowsto reconstruct entire program flow of a given application.This comes with separate machine-dependent tracing backends for tracecollection, trace decoder libraries and an instrumentation tool.Reviewed by: kib (sys/kern bits)Sponsored by: UKRIDifferential Revision: https://reviews.freebsd.org/D40466 List of files: /freebsd/sys/conf/options