D55624.id174733.largetrue.diff
No OneTemporary
Actions

Size

429 KB

Referenced Files

None

Subscribers

None

D55624.id174733.largetrue.diff
View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/MOVED b/MOVED
	--- a/MOVED
	+++ b/MOVED
	@@ -5224,3 +5224,11 @@
	security/openssl33\|\|2026-03-31\|Has expired: Please use security/openssl35 (LTS)
	textproc/lexilla\|\|2026-04-01\|Has expired: No consumers left in the tree, the library is intended to be bundled
	x11-toolkits/scintilla\|\|2026-04-01\|Has expired: No consumers left in the tree, the library is intended to be bundled
	+ports-mgmt/portsnap\|\|2026-04-30\|Has expired: portsnap infrastructure will be removed after the EOL of 13.x
	+security/ktls_isa-l_crypto-kmod\|\|2026-04-30\|Has expired: is only supported on FreeBSD 13
	+security/openssl111\|\|2026-04-30\|End-of-life since 2023-09-11, see https://www.openssl.org/blog/blog/2023/09/11/eol-111/, port will be removed when FreeBSD 13 is EoL
	+graphics/drm-510-kmod\|\|2026-04-30\|only for 13
	+graphics/nvidia-drm-510-kmod\|\|2026-04-30\|only for 13
	+graphics/nvidia-drm-510-kmod-580\|\|2026-04-30\|only for 13
	+graphics/nvidia-drm-510-kmod-devel\|\|2026-04-30\|only for 13
	+devel/kyua\|\|2026-04-30\|Use kyua from base on FreeBSD 14 and newer
	diff --git a/Mk/Features/ssp.mk b/Mk/Features/ssp.mk
	--- a/Mk/Features/ssp.mk
	+++ b/Mk/Features/ssp.mk
	@@ -12,8 +12,7 @@
	_SSP_MK_INCLUDED= yes
	SSP_Include_MAINTAINER= portmgr@FreeBSD.org

	-. if !defined(SSP_UNSAFE) && \
	- (! ${ARCH:Mmips*})
	+. if !defined(SSP_UNSAFE)
	# Overridable as a user may want to use -fstack-protector-all
	SSP_CFLAGS?= -fstack-protector-strong
	CFLAGS+= ${SSP_CFLAGS}
	diff --git a/Mk/Scripts/qa.sh b/Mk/Scripts/qa.sh
	--- a/Mk/Scripts/qa.sh
	+++ b/Mk/Scripts/qa.sh
	@@ -622,7 +622,7 @@
	# ssl
	# When updating this, please also update the versions list in
	# bsd.default-versions.mk and ssl.mk!
	- elif [ ${pkg} = "security/openssl" -o ${pkg} = "security/openssl111" \
	+ elif [ ${pkg} = "security/openssl" \
	-o ${pkg} = "security/openssl34" -o ${pkg} = "security/openssl35" \
	-o ${pkg} = "security/openssl36" \
	-o ${pkg} = "security/libressl" -o ${pkg} = "security/libressl-devel" \
	diff --git a/Mk/Uses/qt-dist.mk b/Mk/Uses/qt-dist.mk
	--- a/Mk/Uses/qt-dist.mk
	+++ b/Mk/Uses/qt-dist.mk
	@@ -265,7 +265,7 @@
	${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_features_qt__module.prf \
	${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_common_bsd_bsd.conf \
	${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_freebsd-clang_qmake.conf
	-. if ${ARCH:Mmips} \|\| (${ARCH:Mpowerpc} && !exists(/usr/bin/clang))
	+. if ${ARCH:Mpowerpc*} && !exists(/usr/bin/clang)
	_EXTRA_PATCHES_QT5+= ${PORTSDIR}/devel/${_QT_RELNAME}/files/extra-patch-mkspecs_common_g++-base.conf \
	${PORTSDIR}/devel/${_QT_RELNAME}/files/extra-patch-mkspecs_common_gcc-base.conf \
	${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_freebsd-g++_qmake.conf
	diff --git a/Mk/Uses/ssl.mk b/Mk/Uses/ssl.mk
	--- a/Mk/Uses/ssl.mk
	+++ b/Mk/Uses/ssl.mk
	@@ -10,7 +10,7 @@
	#
	# When updating this, please also update the same list in bsd.default-versions.mk
	# and the checks for USES=ssl in qa.sh!
	-# Variants being base, openssl, openssl111, openssl34, openssl35,
	+# Variants being base, openssl, openssl34, openssl35,
	# openssl36, libressl, and libressl-devel.
	#
	# The Makefile sets these variables:
	diff --git a/Mk/bsd.default-versions.mk b/Mk/bsd.default-versions.mk
	--- a/Mk/bsd.default-versions.mk
	+++ b/Mk/bsd.default-versions.mk
	@@ -156,7 +156,7 @@
	SAMBA_DEFAULT?= 4.16
	# When updating this, please also update the same list in ssl.mk and the checks
	# for USES=ssl in qa.sh!
	-# Possible values: base, openssl, openssl111, openssl34, openssl35,
	+# Possible values: base, openssl, openssl34, openssl35,
	# openssl36, libressl, libressl-devel
	. if !defined(SSL_DEFAULT)
	# If no preference was set, check for an installed base version
	diff --git a/Mk/bsd.port.mk b/Mk/bsd.port.mk
	--- a/Mk/bsd.port.mk
	+++ b/Mk/bsd.port.mk
	@@ -163,12 +163,12 @@
	# IGNORE_${ARCH} - Port should be ignored on ${ARCH}.
	# IGNORE_${OPSYS} - Port should be ignored on ${OPSYS}.
	# IGNORE_${OPSYS}_${OSREL:R} - Port should be ignored on a single
	-# release of ${OPSYS}, e.g IGNORE_FreeBSD_13
	-# would affect all point releases of FreeBSD 13.
	+# release of ${OPSYS}, e.g IGNORE_FreeBSD_14
	+# would affect all point releases of FreeBSD 14.
	# IGNORE_${OPSYS}_${OSREL:R}_${ARCH} - Port should be ignored on a
	# single release of ${OPSYS} and specific architecture,
	-# e.g IGNORE_FreeBSD_13_i386 would affect all point
	-# releases of FreeBSD 13 in i386.
	+# e.g IGNORE_FreeBSD_14_i386 would affect all point
	+# releases of FreeBSD 14 in i386.
	# BROKEN - Port is believed to be broken. Package builds can
	# still be attempted using TRYBROKEN to test this
	# assumption.
	@@ -179,13 +179,13 @@
	# can still be attempted using TRYBROKEN to
	# test this assumption.
	# BROKEN_${OPSYS}_${OSREL:R} - Port is believed to be broken on a single
	-# release of ${OPSYS}, e.g BROKEN_FreeBSD_13
	-# would affect all point releases of FreeBSD 13
	+# release of ${OPSYS}, e.g BROKEN_FreeBSD_14
	+# would affect all point releases of FreeBSD 14
	# unless TRYBROKEN is also set.
	# BROKEN_${OPSYS}_${OSREL:R}_${ARCH} - Port is believed to be broken on a
	# single release of ${OPSYS} and specific architecture,
	-# e.g BROKEN_FreeBSD_13 would affect all point
	-# releases of FreeBSD 13 in i386
	+# e.g BROKEN_FreeBSD_14 would affect all point
	+# releases of FreeBSD 14 in i386
	# unless TRYBROKEN is also set.
	# DEPRECATED - Port is deprecated to install. Advisory only.
	# EXPIRATION_DATE
	@@ -1165,7 +1165,7 @@
	. endif
	_EXPORTED_VARS+= OSVERSION

	-. if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305000 \|\| (${OSVERSION} >= 1400000 && ${OSVERSION} < 1403000))
	+. if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403000
	_UNSUPPORTED_SYSTEM_MESSAGE= Ports Collection support for your ${OPSYS} version has ended, and no ports\
	are guaranteed to build on this system. Please upgrade to a supported release.
	. if defined(ALLOW_UNSUPPORTED_SYSTEM)
	@@ -2213,11 +2213,7 @@
	. if defined(PKG_NOCOMPRESS)
	PKG_COMPRESSION_FORMAT?= tar
	. else
	-. if ${OSVERSION} > 1400000
	PKG_COMPRESSION_FORMAT?= tzst
	-. else
	-PKG_COMPRESSION_FORMAT?= txz
	-. endif
	. endif

	# where pkg(8) stores its data
	diff --git a/Tools/scripts/tindex b/Tools/scripts/tindex
	--- a/Tools/scripts/tindex
	+++ b/Tools/scripts/tindex
	@@ -27,8 +27,6 @@
	# Location of ports tree and source trees
	export BASEDIR=/a/tindex
	export PORTSDIR=${BASEDIR}/ports
	-export SRCDIR12=${BASEDIR}/src.12
	-export SRCDIR13=${BASEDIR}/src.13
	export SRCDIR14=${BASEDIR}/src.14
	export OUTDIR=${BASEDIR}/out

	@@ -84,7 +82,7 @@
	echo "Committers on the hook:"
	tr -s '\n' ' ' < ${PORTSDIR}/hook
	echo
	- echo
	+ echo
	echo "Most recent Git update was:";
	(IFS=""; echo ${commits})
	) \| mail -s "INDEX build failed for ${BRANCH}" ${REPORT_ADDRESS}
	@@ -113,17 +111,11 @@
	export INDEX_QUIET=1

	# First update the source trees to get current OSVERSION
	-${SVN} -q up ${SRCDIR12}/sys/sys
	-OSVERSION12=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR12}/sys/sys/param.h)
	-
	-${GIT} -C ${SRCDIR13} pull --rebase -q
	-OSVERSION13=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR13}/sys/sys/param.h)
	-
	${GIT} -C ${SRCDIR14} pull --rebase -q
	OSVERSION14=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR14}/sys/sys/param.h)

	cd ${PORTSDIR}
	-for ver in 12 13 14; do
	+for ver in 14; do
	rm -f INDEX-${ver} INDEX-${ver}.bz2 INDEX-${ver}.xz INDEX-${ver}.zst
	done

	@@ -134,7 +126,7 @@
	exit 1
	fi

	-for branch in 12.x 13.x 14.x; do
	+for branch in 14.x; do
	release=$(echo $branch \| sed -e 's,.x,,')

	eval _osver=\$OSVERSION${release}
	diff --git a/accessibility/hyprsunset/Makefile b/accessibility/hyprsunset/Makefile
	--- a/accessibility/hyprsunset/Makefile
	+++ b/accessibility/hyprsunset/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= fails to build: /usr/local/include/date/date.h:6636:15: error: no member named 'read' in namespace 'date::detail'; did you mean '::read'?
	-
	BUILD_DEPENDS= hyprwayland-scanner>=0.4.0:devel/hyprwayland-scanner \
	hyprland-protocols>=0.4.0:graphics/hyprland-protocols \
	wayland-protocols>0:graphics/wayland-protocols
	diff --git a/archivers/lxqt-archiver/Makefile b/archivers/lxqt-archiver/Makefile
	--- a/archivers/lxqt-archiver/Makefile
	+++ b/archivers/lxqt-archiver/Makefile
	@@ -24,10 +24,4 @@
	USE_LXQT= buildtools2 libfmqt6 lxqt
	USE_XORG= xcb

	-.include <bsd.port.pre.mk>
	-
	-.if ${OSVERSION} < 1400504
	-RUN_DEPENDS+= unzip:archivers/unzip
	-.endif
	-
	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/archivers/py-borgbackup/Makefile b/archivers/py-borgbackup/Makefile
	--- a/archivers/py-borgbackup/Makefile
	+++ b/archivers/py-borgbackup/Makefile
	@@ -38,20 +38,6 @@
	FUSE_DESC= Support to mount locally borg backup files
	FUSE_RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}llfuse>0:filesystems/py-llfuse@${PY_FLAVOR}

	-.include <bsd.port.pre.mk>
	-
	-.if (${OPSYS} == FreeBSD) && ${OSVERSION} < 1400033 # why 1400033?
	-# 1. check for the OLDEST (last in list) history entry on the file, when it was added:
	-# git -C /usr/src hist lib/libc/posix1e/acl_extended_file_np.c
	-# 2. check for the version you have obtained what __FreeBSD_version was
	-# and increment by one. This is inaccurate for the interim between file addition
	-# and __FreeBSD_version bump back then, but those versions were no releases and
	-# should no longer be in the field.
	-EXTRA_PATCHES += ${FILESDIR}/extrapatch-setup.py
	-post-patch:
	- ${CP} ${FILESDIR}/acl_extended_file_np.c ${WRKSRC}/src/borg/platform/
	-.endif
	-
	_BORGHOME=${WRKDIR}/testhome
	_BORGENV=-i BORG_PASSPHRASE=secret123 PYTHONPATH=${STAGEDIR}${PYTHON_SITELIBDIR} HOME=${_BORGHOME}
	post-install:
	@@ -87,4 +73,4 @@
	# the PATH dance works around a strange "pkg-config" file not found error.
	cd ${WRKSRC} && ${SETENV} ${_BORGENV} PATH=${PATH}:${LOCALBASE}/bin tox-${PYTHON_VER} -e ${PY_FLAVOR} -vv

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/archivers/py-borgbackup/files/acl_extended_file_np.c b/archivers/py-borgbackup/files/acl_extended_file_np.c
	deleted file mode 100644
	--- a/archivers/py-borgbackup/files/acl_extended_file_np.c
	+++ /dev/null
	@@ -1,83 +0,0 @@
	-/*-
	- * SPDX-License-Identifier: BSD-2-Clause
	- *
	- * Copyright (c) 2021 Gleb Popov
	- * All rights reserved.
	- *
	- * Redistribution and use in source and binary forms, with or without
	- * modification, are permitted provided that the following conditions
	- * are met:
	- * 1. Redistributions of source code must retain the above copyright
	- * notice, this list of conditions and the following disclaimer.
	- * 2. Redistributions in binary form must reproduce the above copyright
	- * notice, this list of conditions and the following disclaimer in the
	- * documentation and/or other materials provided with the distribution.
	- *
	- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	- * SUCH DAMAGE.
	- */
	-/* taken from FreeBSD src branch as of 559a218c9b25 Wed Nov 1 16:43:37 2023 -0600 */
	-/*
	- * acl_extended_file_np: Check if the file has extended ACLs set.
	- */
	-
	-#include <sys/param.h>
	-#include <sys/errno.h>
	-#include <sys/acl.h>
	-
	-#include <unistd.h>
	-
	-typedef acl_t (acl_get_func)(const char , acl_type_t);
	-typedef long (pathconf_func)(const char , int);
	-
	-static int
	-_acl_extended_file(acl_get_func f, pathconf_func pathconf_f, const char* path_p);
	-
	-int
	-acl_extended_file_np(const char *path_p)
	-{
	- return (_acl_extended_file(acl_get_file, pathconf, path_p));
	-}
	-
	-int
	-acl_extended_file_nofollow_np(const char *path_p)
	-{
	- return (_acl_extended_file(acl_get_link_np, lpathconf, path_p));
	-}
	-
	-int
	-acl_extended_link_np(const char *path_p)
	-{
	- return (_acl_extended_file(acl_get_link_np, lpathconf, path_p));
	-}
	-
	-int
	-_acl_extended_file(acl_get_func acl_get, pathconf_func pathconf_f, const char* path_p)
	-{
	- acl_t acl;
	- int retval, istrivial, acltype = ACL_TYPE_ACCESS;
	-
	- retval = pathconf_f(path_p, _PC_ACL_NFS4);
	- if (retval > 0)
	- acltype = ACL_TYPE_NFS4;
	-
	- acl = acl_get(path_p, acltype);
	- if (acl == NULL)
	- return (-1);
	-
	- retval = acl_is_trivial_np(acl, &istrivial);
	- acl_free(acl);
	- if (retval == -1)
	- return (-1);
	-
	- return (!istrivial);
	-}
	diff --git a/archivers/py-borgbackup/files/extrapatch-setup.py b/archivers/py-borgbackup/files/extrapatch-setup.py
	deleted file mode 100644
	--- a/archivers/py-borgbackup/files/extrapatch-setup.py
	+++ /dev/null
	@@ -1,11 +0,0 @@
	---- setup.py.orig 2024-07-02 22:06:38 UTC
	-+++ setup.py
	-@@ -181,7 +181,7 @@ if not on_rtd:
	- syncfilerange_ext = Extension(
	- "borg.platform.syncfilerange", [platform_syncfilerange_source], extra_compile_args=cflags
	- )
	-- freebsd_ext = Extension("borg.platform.freebsd", [platform_freebsd_source], extra_compile_args=cflags)
	-+ freebsd_ext = Extension("borg.platform.freebsd", [platform_freebsd_source, 'src/borg/platform/acl_extended_file_np.c'], extra_compile_args=cflags)
	- darwin_ext = Extension("borg.platform.darwin", [platform_darwin_source], extra_compile_args=cflags)
	- windows_ext = Extension("borg.platform.windows", [platform_windows_source], extra_compile_args=cflags)
	-
	diff --git a/astro/openuniverse/Makefile b/astro/openuniverse/Makefile
	--- a/astro/openuniverse/Makefile
	+++ b/astro/openuniverse/Makefile
	@@ -17,13 +17,6 @@
	USE_XORG= ice sm x11 xext xi xmu xorgproto

	GNU_CONFIGURE= yes
	-
	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
	-LIBS+= -lcompat
	-.else
	LIBS+= -lutil
	-.endif

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/audio/ardour/Makefile b/audio/ardour/Makefile
	--- a/audio/ardour/Makefile
	+++ b/audio/ardour/Makefile
	@@ -113,14 +113,4 @@
	post-install-VST3-on:
	@${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/${ARDOUR_MAJOR}/ardour-vst3-scanner

	-.include <bsd.port.pre.mk>
	-
	-# Some peripheral libraries are only built with libusb-1.0 >= 1.0.16
	-.if ${OPSYS} == FreeBSD && \
	- (1500000 <= ${OSVERSION} && ${OSVERSION} <= 1500019)
	-PLIST_SUB+= LIBUSB="@comment "
	-.else
	-PLIST_SUB+= LIBUSB=""
	-.endif
	-
	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/audio/ardour/pkg-plist b/audio/ardour/pkg-plist
	--- a/audio/ardour/pkg-plist
	+++ b/audio/ardour/pkg-plist
	@@ -92,7 +92,7 @@
	lib/%%ARDOUR_MAJOR%%/sanityCheck
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_cc121.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_console1.so
	-%%LIBUSB%%lib/%%ARDOUR_MAJOR%%/surfaces/libardour_contourdesign.so
	+lib/%%ARDOUR_MAJOR%%/surfaces/libardour_contourdesign.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport16.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport2.so
	@@ -105,7 +105,7 @@
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_launchpad_x.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_mcp.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_osc.so
	-%%LIBUSB%%lib/%%ARDOUR_MAJOR%%/surfaces/libardour_push2.so
	+lib/%%ARDOUR_MAJOR%%/surfaces/libardour_push2.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_ssl_uf8.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_us2400.so
	lib/%%ARDOUR_MAJOR%%/surfaces/libardour_websockets.so
	diff --git a/audio/denemo/Makefile b/audio/denemo/Makefile
	--- a/audio/denemo/Makefile
	+++ b/audio/denemo/Makefile
	@@ -10,8 +10,6 @@

	LICENSE= GPLv3+

	-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
	-
	LIB_DEPENDS= libaubio.so:audio/aubio \
	libfluidsynth.so:audio/fluidsynth \
	libjack.so:audio/jack \
	diff --git a/audio/id3lib/Makefile b/audio/id3lib/Makefile
	--- a/audio/id3lib/Makefile
	+++ b/audio/id3lib/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= GPLv2+
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= fails to link: '_ZTSN12_GLOBAL__N_117ConstIteratorImplE' referenced in section '.data.rel.ro' of tag.lo: defined in discarded section
	-BROKEN_mips64= fails to link: '_ZTSN12_GLOBAL__N_117ConstIteratorImplE' referenced in section '.data.rel.ro' of tag.lo: defined in discarded section
	-
	USES= cmake compiler:c11 cpe iconv pkgconfig

	CMAKE_OFF= WITH_DOCS WITH_TESTS
	diff --git a/audio/ncmpcpp/Makefile b/audio/ncmpcpp/Makefile
	--- a/audio/ncmpcpp/Makefile
	+++ b/audio/ncmpcpp/Makefile
	@@ -50,12 +50,6 @@
	VISUALIZER_CONFIGURE_ENABLE= visualizer
	VISUALIZER_CONFIGURE_WITH= fftw

	-.include <bsd.port.options.mk>
	-
	-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
	-CONFIGURE_ENV= ncursesw_CFLAGS="-L${NCURSESLIB}" ncursesw_LIBS="-lncursesw"
	-.endif
	-
	post-install:
	${INSTALL_PROGRAM} ${WRKSRC}/src/ncmpcpp ${STAGEDIR}${PREFIX}/bin/

	diff --git a/audio/pipewire-spa-oss/Makefile b/audio/pipewire-spa-oss/Makefile
	--- a/audio/pipewire-spa-oss/Makefile
	+++ b/audio/pipewire-spa-oss/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-ONLY_FOR_ARCHS= aarch64 amd64 riscv64 riscv64sf
	+ONLY_FOR_ARCHS= aarch64 amd64 riscv64

	LIB_DEPENDS= libpipewire-0.3.so:multimedia/pipewire

	diff --git a/audio/siren/Makefile b/audio/siren/Makefile
	--- a/audio/siren/Makefile
	+++ b/audio/siren/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= ISCL
	LICENSE_FILE= ${WRKSRC}/LICENCE

	-BROKEN_mips= fails to configure: cannot find program /nxb-bin/usr/bin/cc
	-BROKEN_mips64= fails to configure: cannot find program /nxb-bin/usr/bin/cc
	-
	USES= localbase:ldflags ncurses pkgconfig
	HAS_CONFIGURE= yes
	USE_CSTD= c99
	diff --git a/audio/xmcd/Makefile b/audio/xmcd/Makefile
	--- a/audio/xmcd/Makefile
	+++ b/audio/xmcd/Makefile
	@@ -8,8 +8,6 @@
	COMMENT= Motif CD player
	WWW= https://www.ibiblio.org/tkan/xmcd/

	-BROKEN_mips64= Fails to compile: many undefined symbols in xorg.cf
	-
	LIB_DEPENDS+= libvorbis.so:audio/libvorbis \
	libFLAC.so:audio/flac
	RUN_DEPENDS+= lame:audio/lame
	diff --git a/benchmarks/libmicro/Makefile b/benchmarks/libmicro/Makefile
	--- a/benchmarks/libmicro/Makefile
	+++ b/benchmarks/libmicro/Makefile
	@@ -8,7 +8,6 @@

	LICENSE= CDDL

	-BROKEN_mips64= Fails to build: bin-mips64: no such file or directory
	BROKEN_riscv64= Fails to build: bin-riscv64: no such file or directory

	USES= gmake
	diff --git a/biology/avida/Makefile b/biology/avida/Makefile
	--- a/biology/avida/Makefile
	+++ b/biology/avida/Makefile
	@@ -13,8 +13,6 @@
	BROKEN_aarch64= invokes x86 assembler
	BROKEN_armv6= invokes x86 assembler
	BROKEN_armv7= invokes x86 assembler
	-BROKEN_mips= invokes x86 assembler
	-BROKEN_mips64= invokes x86 assembler
	BROKEN_riscv64= invokes x86 assembler

	USES= compiler:c11 cmake ncurses
	diff --git a/biology/btllib/Makefile b/biology/btllib/Makefile
	--- a/biology/btllib/Makefile
	+++ b/biology/btllib/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # temporary until https://github.com/bcgsc/btllib/issues/117 is fixed
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # temporary until https://github.com/bcgsc/btllib/issues/117 is fixed

	BUILD_DEPENDS= bash:shells/bash \
	samtools:biology/samtools \
	diff --git a/biology/bwa/Makefile b/biology/bwa/Makefile
	--- a/biology/bwa/Makefile
	+++ b/biology/bwa/Makefile
	@@ -12,10 +12,6 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/COPYING

	-# Recheck these after 0.7.18 update
	-BROKEN_mips= fails to compile: cc1: unrecognized command line option "-msse2"
	-BROKEN_mips64= fails to compile: cc1: unrecognized command line option "-msse2"
	-
	BUILD_DEPENDS= simde>0:devel/simde

	USES= gmake localbase perl5 shebangfix
	diff --git a/biology/canu/Makefile b/biology/canu/Makefile
	--- a/biology/canu/Makefile
	+++ b/biology/canu/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKDIR}/${PORTNAME}-${PORTVERSION}/README.license.GPL

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= Requires 64-bit processor

	LIB_DEPENDS= libboost_regex.so:devel/boost-libs
	diff --git a/biology/hhsuite/Makefile b/biology/hhsuite/Makefile
	--- a/biology/hhsuite/Makefile
	+++ b/biology/hhsuite/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe # not for 32-bit architectures, see https://github.com/soedinglab/hh-suite/issues/322#issuecomment-1264416293
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe # not for 32-bit architectures, see https://github.com/soedinglab/hh-suite/issues/322#issuecomment-1264416293

	LIB_DEPENDS= libmpi.so:net/openmpi

	diff --git a/biology/metaeuk/Makefile b/biology/metaeuk/Makefile
	--- a/biology/metaeuk/Makefile
	+++ b/biology/metaeuk/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENCE.md

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # 32-bit platforms produce wrong results based on https://github.com/soedinglab/metaeuk/issues/85#issuecomment-1888379107
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # 32-bit platforms produce wrong results based on https://github.com/soedinglab/metaeuk/issues/85#issuecomment-1888379107
	NOT_FOR_ARCHS+= powerpc64 # many modules produce wrong results on big-endian architectures

	BUILD_DEPENDS= xxd:editors/vim
	diff --git a/biology/migrate/Makefile b/biology/migrate/Makefile
	--- a/biology/migrate/Makefile
	+++ b/biology/migrate/Makefile
	@@ -15,7 +15,6 @@
	# Waiting on build reports, 2024-03-27
	#BROKEN_armv6= fails to build: make[2]: cannot open makefile
	#BROKEN_armv7= fails to build: make[2]: cannot open makefile
	-#BROKEN_mips= fails to build: make[2]: cannot open makefile
	#BROKEN_riscv64= fails to build: make[2]: cannot open makefile

	GNU_CONFIGURE= yes
	diff --git a/biology/minimap2/Makefile b/biology/minimap2/Makefile
	--- a/biology/minimap2/Makefile
	+++ b/biology/minimap2/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE.txt

	-NOT_FOR_ARCHS= i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= Requires 64-bit processor, except ARM NEON

	BUILD_DEPENDS= simde>0:devel/simde
	diff --git a/biology/mmseqs2/Makefile b/biology/mmseqs2/Makefile
	--- a/biology/mmseqs2/Makefile
	+++ b/biology/mmseqs2/Makefile
	@@ -9,7 +9,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE.md

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe

	BUILD_DEPENDS= zstd>0:archivers/zstd

	diff --git a/biology/plink/Makefile b/biology/plink/Makefile
	--- a/biology/plink/Makefile
	+++ b/biology/plink/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= aarch64 mips64 powerpc64
	+NOT_FOR_ARCHS= aarch64 powerpc64
	NOT_FOR_ARCHS_REASON= 64bit code requires SSE2 instructions

	USES= gmake fortran
	diff --git a/biology/preseq/Makefile b/biology/preseq/Makefile
	--- a/biology/preseq/Makefile
	+++ b/biology/preseq/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= 32-bit platforms are not useful for bioinformatics

	LIB_DEPENDS= libhts.so:biology/htslib
	diff --git a/biology/salmon/Makefile b/biology/salmon/Makefile
	--- a/biology/salmon/Makefile
	+++ b/biology/salmon/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= Requires 64-bit processor

	# libtool and auto* are run manually in submodules, so don't put them in USES
	diff --git a/biology/star/Makefile b/biology/star/Makefile
	--- a/biology/star/Makefile
	+++ b/biology/star/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKDIR}/STAR-${DISTVERSION}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= Requires 64-bit processor
	.if !exists(/usr/include/omp.h)
	BROKEN= requires OpenMP support that is missing on this architecture
	diff --git a/cad/astk-serveur/Makefile b/cad/astk-serveur/Makefile
	--- a/cad/astk-serveur/Makefile
	+++ b/cad/astk-serveur/Makefile
	@@ -14,7 +14,7 @@

	LICENSE= GPLv2

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= ARG_MAX is too small for Code_Aster on 32 bits systems

	#-----------------------------------------------------------------------
	diff --git a/cad/fritzing/Makefile b/cad/fritzing/Makefile
	--- a/cad/fritzing/Makefile
	+++ b/cad/fritzing/Makefile
	@@ -50,10 +50,4 @@
	-f ${STAGEDIR}${DATADIR} \
	-platform offscreen

	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000 && ${SSL_DEFAULT} == "base"
	-IGNORE= Requires OpenSSL >= 3
	-.endif
	-
	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/cad/gnucap/Makefile b/cad/gnucap/Makefile
	--- a/cad/gnucap/Makefile
	+++ b/cad/gnucap/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= defined in discarded section
	-BROKEN_mips64= defined in discarded section
	-
	USES= gmake
	USE_LDCONFIG= yes

	diff --git a/cad/opencascade/Makefile b/cad/opencascade/Makefile
	--- a/cad/opencascade/Makefile
	+++ b/cad/opencascade/Makefile
	@@ -144,7 +144,7 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == mips \|\| ${ARCH} == powerpc \|\| ${ARCH} == powerpcspe \|\| ${ARCH} == "i386"
	+.if ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == powerpc \|\| ${ARCH} == powerpcspe \|\| ${ARCH} == "i386"
	BITS= 32
	.else
	BITS= 64
	diff --git a/comms/librs232/Makefile b/comms/librs232/Makefile
	--- a/comms/librs232/Makefile
	+++ b/comms/librs232/Makefile
	@@ -22,7 +22,7 @@

	.include <bsd.port.options.mk>

	-.if defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
	+.if defined(NO_PROFILE) \|\| ${OPSYS} == FreeBSD
	PLIST_SUB+= PROFILE="@comment "
	.else
	PLIST_SUB+= PROFILE=""
	diff --git a/comms/mgetty+sendfax/Makefile b/comms/mgetty+sendfax/Makefile
	--- a/comms/mgetty+sendfax/Makefile
	+++ b/comms/mgetty+sendfax/Makefile
	@@ -12,7 +12,6 @@
	LICENSE= GPLv2

	BROKEN_aarch64= fails to compile: error: initializer element is not a compile-time constant
	-BROKEN_mips64= fails to compile: error: initializer element is not a compile-time constant
	BROKEN_riscv64= fails to compile: error: initializer element is not a compile-time constant

	USES= cpe makeinfo perl5 shebangfix
	diff --git a/comms/snap7/files/patch-mips__bsd.mk b/comms/snap7/files/patch-mips__bsd.mk
	deleted file mode 100644
	--- a/comms/snap7/files/patch-mips__bsd.mk
	+++ /dev/null
	@@ -1,15 +0,0 @@
	---- mips_bsd.mk.orig 2016-12-20 10:44:15 UTC
	-+++ mips_bsd.mk
	-@@ -0,0 +1,12 @@
	-+##
	-+## mips BSD based (FreeBSD etc.) Makefile
	-+## Use gmake instead of make
	-+##
	-+TargetCPU :=mips
	-+OS :=bsd
	-+CXXFLAGS := -O3 -fPIC -pedantic
	-+
	-+# Standard part
	-+
	-+include common.mk
	-+
	diff --git a/comms/uhd/Makefile b/comms/uhd/Makefile
	--- a/comms/uhd/Makefile
	+++ b/comms/uhd/Makefile
	@@ -33,10 +33,6 @@
	USE_GITHUB= yes
	GH_ACCOUNT= EttusResearch

	-BROKEN_FreeBSD_13_aarch64= fails to configure: Could not find standard set_new_handler function
	-BROKEN_FreeBSD_13_armv6= fails to configure: Could not find standard set_new_handler function
	-BROKEN_FreeBSD_13_armv7= fails to configure: Could not find standard set_new_handler function
	-
	CMAKE_SOURCE_PATH= ${WRKSRC}/host
	#CXXFLAGS_amd64= -msse2 -std=c++11
	CXXFLAGS_i386= -msse2
	diff --git a/converters/iconv/Makefile b/converters/iconv/Makefile
	--- a/converters/iconv/Makefile
	+++ b/converters/iconv/Makefile
	@@ -27,7 +27,7 @@

	.include <bsd.port.pre.mk>

	-.if defined(NO_PROFILE) \|\| ${OSVERSION} > 1400001
	+.if defined(NO_PROFILE) \|\| ${OPSYS} == FreeBSD
	PLIST_SUB+= PROFILE="@comment "
	.else
	PLIST_SUB+= PROFILE=""
	diff --git a/databases/db18/Makefile b/databases/db18/Makefile
	--- a/databases/db18/Makefile
	+++ b/databases/db18/Makefile
	@@ -20,8 +20,6 @@
	LICENSE_FILE= ${WRKSRC}/../LICENSE
	LICENSE_PERMS_UPL10= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept

	-BROKEN_mips64= no usable MUTEX implementation, assy works only for MIPS32, POSIX mutexes are unshared
	-
	USES= gmake libtool ssl
	USE_LDCONFIG= yes

	diff --git a/databases/kyotocabinet/Makefile b/databases/kyotocabinet/Makefile
	--- a/databases/kyotocabinet/Makefile
	+++ b/databases/kyotocabinet/Makefile
	@@ -11,9 +11,6 @@

	LICENSE= GPLv3

	-BROKEN_mips= fails to link: hidden symbol '__sync_lock_test_and_set_8' in /usr/lib/libgcc.a(stdatomic.o) is referenced by DSO
	-BROKEN_mips64= fails to link: hidden symbol '__sync_lock_test_and_set_8' in /usr/lib/libgcc.a(stdatomic.o) is referenced by DSO
	-
	USES= compiler:c++11-lang gmake

	CPPFLAGS+= -fPIC
	diff --git a/databases/ldb25/Makefile b/databases/ldb25/Makefile
	--- a/databases/ldb25/Makefile
	+++ b/databases/ldb25/Makefile
	@@ -69,7 +69,7 @@
	lib/shared-modules/ldb/ldb.so lib/shared-modules/ldb/ldap.so \
	lib/shared-modules/ldb/asq.so lib/shared-modules/ldb/tdb.so
	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
	${ARCH} != powerpc && ${ARCH} != powerpcspe
	LDB_LIBS+= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
	.endif
	diff --git a/databases/ldb28/Makefile b/databases/ldb28/Makefile
	--- a/databases/ldb28/Makefile
	+++ b/databases/ldb28/Makefile
	@@ -104,7 +104,7 @@
	.endif

	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
	${ARCH} != powerpc && ${ARCH} != powerpcspe
	_LDB_LIBS_64= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
	.endif
	diff --git a/databases/ldb29/Makefile b/databases/ldb29/Makefile
	--- a/databases/ldb29/Makefile
	+++ b/databases/ldb29/Makefile
	@@ -104,7 +104,7 @@
	.endif

	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
	${ARCH} != powerpc && ${ARCH} != powerpcspe
	_LDB_LIBS_64= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
	.endif
	diff --git a/databases/libcouchbase/Makefile b/databases/libcouchbase/Makefile
	--- a/databases/libcouchbase/Makefile
	+++ b/databases/libcouchbase/Makefile
	@@ -10,8 +10,6 @@

	LICENSE= APACHE20

	-BROKEN_mips64= fails to link: ld: failed to merge target specific data
	-
	LIB_DEPENDS= libev.so:devel/libev \
	libevent.so:devel/libevent \
	libuv.so:devel/libuv
	diff --git a/databases/postgresql-plv8js/Makefile b/databases/postgresql-plv8js/Makefile
	--- a/databases/postgresql-plv8js/Makefile
	+++ b/databases/postgresql-plv8js/Makefile
	@@ -22,7 +22,7 @@

	CXXFLAGS+= -std=c++17 -fno-rtti
	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	CXXFLAGS+= -DV8_COMPRESS_POINTERS=1 -DV8_31BIT_SMIS_ON_64BIT_ARCH=1
	.endif
	MAKE_ARGS= CUSTOM_CC=${CXX} CCFLAGS="${CXXFLAGS}"
	diff --git a/databases/soci/Makefile b/databases/soci/Makefile
	--- a/databases/soci/Makefile
	+++ b/databases/soci/Makefile
	@@ -27,8 +27,6 @@
	OPTIONS_EXCLUDE_aarch64= FIREBIRD
	OPTIONS_EXCLUDE_armv6= FIREBIRD
	OPTIONS_EXCLUDE_armv7= FIREBIRD
	-OPTIONS_EXCLUDE_mips= FIREBIRD
	-OPTIONS_EXCLUDE_mips64= FIREBIRD
	OPTIONS_EXCLUDE_powerpc= FIREBIRD
	OPTIONS_EXCLUDE_powerpc64= FIREBIRD
	OPTIONS_EXCLUDE_powerpc64le= FIREBIRD
	diff --git a/devel/Makefile b/devel/Makefile
	--- a/devel/Makefile
	+++ b/devel/Makefile
	@@ -1193,7 +1193,6 @@
	SUBDIR += kronosnet
	SUBDIR += ktextaddons
	SUBDIR += kunifiedpush
	- SUBDIR += kyua
	SUBDIR += lab
	SUBDIR += lace
	SUBDIR += lace14
	diff --git a/devel/aarch64-none-elf-gcc/Makefile b/devel/aarch64-none-elf-gcc/Makefile
	--- a/devel/aarch64-none-elf-gcc/Makefile
	+++ b/devel/aarch64-none-elf-gcc/Makefile
	@@ -12,9 +12,6 @@
	LICENSE= GPLv3 GPLv3RLE
	LICENSE_COMB= multi

	-BROKEN_mips= configure: error: cannot compute suffix of object files: cannot compile
	-BROKEN_mips64= configure: error: cannot compute suffix of object files: cannot compile
	-
	LIB_DEPENDS= libgmp.so:math/gmp \
	libmpfr.so:math/mpfr \
	libmpc.so:math/mpc
	diff --git a/devel/avr-gcc/Makefile b/devel/avr-gcc/Makefile
	--- a/devel/avr-gcc/Makefile
	+++ b/devel/avr-gcc/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= GPLv3 GPLv3RLE
	LICENSE_COMB= multi

	-BROKEN_mips64= Fails to configure: cannot compute suffix of object files
	-
	BUILD_DEPENDS= avr-as:devel/binutils@avr \
	avr-ld:devel/binutils@avr \
	objdump:devel/binutils
	diff --git a/devel/bcc/Makefile b/devel/bcc/Makefile
	--- a/devel/bcc/Makefile
	+++ b/devel/bcc/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= GPLv2

	BROKEN_aarch64= fails to link: error adding symbols: File in wrong format
	-BROKEN_mips= fails to compile: unrecognized command line option "-m32"
	-BROKEN_mips64= fails to compile: unrecognized command line option "-m32"

	USES= uidfix

	diff --git a/devel/binutils/Makefile b/devel/binutils/Makefile
	--- a/devel/binutils/Makefile
	+++ b/devel/binutils/Makefile
	@@ -21,7 +21,7 @@
	LIB_DEPENDS= libzstd.so:archivers/zstd

	FLAVORS= native aarch64 aarch64_none_elf amd64 arm_gnueabi arm_none_eabi \
	- avr i386 mingw32 mips mips64 powerpc powerpc64 powerpc64le riscv64 \
	+ avr i386 mingw32 powerpc powerpc64 powerpc64le riscv64 \
	riscv64_none_elf s390x riscv32_unknown_elf
	FLAVOR?= native

	@@ -80,10 +80,7 @@
	PLIST_SUB= BUTARGET=${BUTARGET}
	INFO_PATH= ${PKGNAMEPREFIX:S/-$//}/share/info

	-.if ${FLAVOR} == aarch64
	-BROKEN_mips= fails to configure: error: C compiler cannot create executables
	-BROKEN_mips64= fails to configure: error: C compiler cannot create executables
	-.elif ${FLAVOR} == aarch64_none_elf \|\| ${FLAVOR} == arm_none_eabi \|\| ${FLAVOR} == riscv64_none_elf \|\| ${FLAVOR} == mingw32 \|\| ${FLAVOR} == avr \|\| ${FLAVOR} == riscv32_unknown_elf
	+.if ${FLAVOR} == aarch64_none_elf \|\| ${FLAVOR} == arm_none_eabi \|\| ${FLAVOR} == riscv64_none_elf \|\| ${FLAVOR} == mingw32 \|\| ${FLAVOR} == avr \|\| ${FLAVOR} == riscv32_unknown_elf
	BUTARGET= ${FLAVOR:C/_/-/g}
	.elif ${FLAVOR} == amd64
	BUTARGET= x86_64-unknown-${OPSYS:tl}${OSREL}
	@@ -133,7 +130,7 @@
	.include <bsd.port.pre.mk>

	# Actual earliest version may differ slightly
	-.if (${ARCH} != mips && ${ARCH} != mips64 && ${ARCH} != powerpcspe && ${ARCH} != powerpc && ${ARCH} != powerpc64 && ${ARCH} != riscv64 && !defined(PKGNAMEPREFIX)) \|\| ((${ARCH} == powerpc \|\| ${ARCH} == powerpc64) && ${CHOSEN_COMPILER_TYPE} != gcc && !defined(PKGNAMEPREFIX))
	+.if (${ARCH} != powerpcspe && ${ARCH} != powerpc && ${ARCH} != powerpc64 && ${ARCH} != riscv64 && !defined(PKGNAMEPREFIX)) \|\| ((${ARCH} == powerpc \|\| ${ARCH} == powerpc64) && ${CHOSEN_COMPILER_TYPE} != gcc && !defined(PKGNAMEPREFIX))
	CONFIGURE_ARGS+= --enable-gold --enable-plugins
	CXXFLAGS+= -Wno-c++11-narrowing
	PLIST_SUB+= GOLD=""
	diff --git a/devel/boost-all/compiled.mk b/devel/boost-all/compiled.mk
	--- a/devel/boost-all/compiled.mk
	+++ b/devel/boost-all/compiled.mk
	@@ -46,8 +46,7 @@
	.include <bsd.port.options.mk>

	.if ${OPSYS} == FreeBSD && \
	- ((${OSVERSION} >= 1500000 && ${OSVERSION} < 1500017) \|\| \
	- ${PORT_OPTIONS:MLLVM_FROM_PORTS})
	+ ${PORT_OPTIONS:MLLVM_FROM_PORTS}
	USES+= llvm:build
	USES:= ${USES:Ncompiler\:*} # XXX avoid warnings
	CHOSEN_COMPILER_TYPE= clang
	diff --git a/devel/boost-libs/Makefile b/devel/boost-libs/Makefile
	--- a/devel/boost-libs/Makefile
	+++ b/devel/boost-libs/Makefile
	@@ -15,8 +15,6 @@
	# Build of this port fails with assertion failure of compiler due to
	# bug of LLVM/Clang in base system. The failure happens when all of
	# following conditions are satisfied.
	-# * OSVERSION is included in either of following ranges.
	-# 1. 1500000 <= OSVERSION < 1500017
	# * Base system is built with WITH_LLVM_ASSERTIONS variable set.
	# So if your base system fulfills them you need to use LLVM ports to
	# build this port.
	diff --git a/devel/cjose/Makefile b/devel/cjose/Makefile
	--- a/devel/cjose/Makefile
	+++ b/devel/cjose/Makefile
	@@ -28,7 +28,7 @@
	CFLAGS+= -Wno-error=strict-prototypes
	.endif

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CFLAGS+= -Wno-error=deprecated-declarations
	.endif

	diff --git a/devel/cpu_features/Makefile b/devel/cpu_features/Makefile
	--- a/devel/cpu_features/Makefile
	+++ b/devel/cpu_features/Makefile
	@@ -10,8 +10,8 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= mips mips64 riscv64
	-NOT_FOR_ARCHS_REASON= assumes android if on MIPS; not ported to riscv64
	+NOT_FOR_ARCHS= riscv64
	+NOT_FOR_ARCHS_REASON= not ported to riscv64

	USES= cmake:testing
	USE_GITHUB= yes
	diff --git a/devel/critcl/Makefile b/devel/critcl/Makefile
	--- a/devel/critcl/Makefile
	+++ b/devel/critcl/Makefile
	@@ -20,7 +20,7 @@
	TEST_TARGET= test

	PLIST_SUB= VER=${PORTVERSION} \
	- ARCH=${ARCH:C/arm./arm/:S/i386/ix86/:S/aarch64/arm/:S/mips64/mips/:C/powerpc64./powerpc/}
	+ ARCH=${ARCH:C/arm./arm/:S/i386/ix86/:S/aarch64/arm/:C/powerpc64./powerpc/}

	PORTDOCS= *

	diff --git a/devel/cssc/Makefile b/devel/cssc/Makefile
	--- a/devel/cssc/Makefile
	+++ b/devel/cssc/Makefile
	@@ -11,9 +11,6 @@

	LICENSE= GPLv3

	-BROKEN_mips= fails to compile: ../gl/lib/unistd.h:135:3: "Please include config.h first."
	-BROKEN_mips64= fails to compile: ../gl/lib/unistd.h:135:3: "Please include config.h first."
	-
	USES= compiler:c11

	GNU_CONFIGURE= yes
	diff --git a/devel/cxxtools/Makefile b/devel/cxxtools/Makefile
	--- a/devel/cxxtools/Makefile
	+++ b/devel/cxxtools/Makefile
	@@ -12,8 +12,6 @@
	LICENSE_FILE= ${WRKSRC}/COPYING

	BROKEN_aarch64= does not configure: error: check for atomictype failed
	-BROKEN_mips= does not configure: in section .data.rel.ro of csvdeserializer-test.o: defined in discarded section
	-BROKEN_mips64= does not configure: in section .data.rel.ro of csvdeserializer-test.o: defined in discarded section
	BROKEN_riscv64= does not configure: error: check for atomictype failed

	USES= cpe iconv libtool localbase pathfix
	@@ -51,12 +49,6 @@
	PLIST_SUB+= ARM_ONLY="@comment "
	.endif

	-.if ${ARCH:Mmips*}
	-PLIST_SUB+= MIPS_ONLY=""
	-.else
	-PLIST_SUB+= MIPS_ONLY="@comment "
	-.endif
	-
	.if ${ARCH:Mpowerpc*}
	PLIST_SUB+= PPC_ONLY=""
	.else
	diff --git a/devel/cxxtools/pkg-plist b/devel/cxxtools/pkg-plist
	--- a/devel/cxxtools/pkg-plist
	+++ b/devel/cxxtools/pkg-plist
	@@ -32,7 +32,6 @@
	%%X86_64_ONLY%%include/cxxtools/atomicity.gcc.x86_64.h
	%%I386_ONLY%%include/cxxtools/atomicity.gcc.x86.h
	%%ARM_ONLY%%include/cxxtools/atomicity.gcc.arm.h
	-%%MIPS_ONLY%%include/cxxtools/atomicity.gcc.mips.h
	%%PPC_ONLY%%include/cxxtools/atomicity.gcc.ppc.h
	include/cxxtools/atomicity.h
	include/cxxtools/base64codec.h
	@@ -126,7 +125,6 @@
	include/cxxtools/membar.gcc.nosmp.h
	%%X86_ONLY%%include/cxxtools/membar.gcc.x86.h
	%%ARM_ONLY%%include/cxxtools/membar.gcc.arm.h
	-%%MIPS_ONLY%%include/cxxtools/membar.gcc.mips.h
	%%PPC_ONLY%%include/cxxtools/membar.gcc.ppc.h
	include/cxxtools/membar.h
	include/cxxtools/method.h
	diff --git a/devel/dbus/Makefile b/devel/dbus/Makefile
	--- a/devel/dbus/Makefile
	+++ b/devel/dbus/Makefile
	@@ -79,10 +79,4 @@
	${MV} ${file} ${file}.sample
	.endfor

	-.include <bsd.port.pre.mk>
	-
	-.if ${OSVERSION} < 1400000
	-MESON_ARGS+= -Db_lundef=false
	-.endif
	-
	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/devel/efivar/Makefile b/devel/efivar/Makefile
	--- a/devel/efivar/Makefile
	+++ b/devel/efivar/Makefile
	@@ -11,7 +11,6 @@

	NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= specification only supports little-endian processors
	-BROKEN_FreeBSD_13= requires at least FreeBSD 14

	BUILD_DEPENDS= gsed:textproc/gsed
	LIB_DEPENDS= libpopt.so:devel/popt
	diff --git a/devel/folly/Makefile b/devel/folly/Makefile
	--- a/devel/folly/Makefile
	+++ b/devel/folly/Makefile
	@@ -10,7 +10,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= compilation fails: use of undeclared identifier 'clearenv'
	BROKEN_i386= error: use of undeclared identifier 'DCHECK': https://github.com/facebook/folly/issues/1168
	BROKEN_powerpc= compilation fails: Big endian requires a redesigned table (assert in folly/detail/base64_detail/Base64SWAR.cpp:107)
	BROKEN_powerpc64= compilation fails: Big endian requires a redesigned table (assert in folly/detail/base64_detail/Base64SWAR.cpp:107)
	diff --git a/devel/gcc-arm-embedded/Makefile b/devel/gcc-arm-embedded/Makefile
	--- a/devel/gcc-arm-embedded/Makefile
	+++ b/devel/gcc-arm-embedded/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= GPLv2 LGPL20 LGPL21 GPLv3 LGPL3
	LICENSE_COMB= multi

	-NOT_FOR_ARCHS= arm armv6 armv7 mips mips64 mips64el mipsel mipsn32
	+NOT_FOR_ARCHS= arm armv6 armv7
	NOT_FOR_ARCHS_REASON= Very slow to build on emulator

	BUILD_DEPENDS= bash:shells/bash \
	diff --git a/devel/hyprwire/Makefile b/devel/hyprwire/Makefile
	--- a/devel/hyprwire/Makefile
	+++ b/devel/hyprwire/Makefile
	@@ -27,12 +27,6 @@

	OPTIONS_DEFINE= DOCS

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	post-install-DOCS-on:
	@${MKDIR} ${STAGEDIR}${DOCSDIR}
	${INSTALL_MAN} ${PORTDOCS:S\|^\|${WRKSRC}/\|} ${STAGEDIR}${DOCSDIR}
	diff --git a/devel/judy/Makefile b/devel/judy/Makefile
	--- a/devel/judy/Makefile
	+++ b/devel/judy/Makefile
	@@ -10,9 +10,6 @@

	LICENSE= LGPL21

	-BROKEN_mips= fails to compile: unrecognized command line option "-m32"
	-BROKEN_mips64= fails to compile: unrecognized command line option "-m64"
	-
	USES= gmake libtool
	GNU_CONFIGURE= yes
	GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
	diff --git a/devel/kunifiedpush/Makefile b/devel/kunifiedpush/Makefile
	--- a/devel/kunifiedpush/Makefile
	+++ b/devel/kunifiedpush/Makefile
	@@ -11,6 +11,4 @@
	ecm:build
	USE_QT= base declarative websockets

	-IGNORE_FreeBSD_13= does not build with OpenSSL 1.1.1
	-
	.include <bsd.port.mk>
	diff --git a/devel/kyua/Makefile b/devel/kyua/Makefile
	deleted file mode 100644
	--- a/devel/kyua/Makefile
	+++ /dev/null
	@@ -1,55 +0,0 @@
	-PORTNAME= kyua
	-DISTVERSION= 0.14.1
	-PORTEPOCH= 3
	-CATEGORIES= devel
	-MASTER_SITES= https://github.com/freebsd/${PORTNAME}/releases/download/${DISTNAME}/
	-
	-MAINTAINER= bofh@FreeBSD.org
	-COMMENT= Testing framework for infrastructure software
	-WWW= https://github.com/freebsd/kyua/
	-
	-LICENSE= BSD3CLAUSE
	-
	-LIB_DEPENDS= liblutok.so:devel/lutok
	-
	-USES= autoreconf libtool lua pkgconfig sqlite
	-USE_CXXSTD= gnu++14
	-
	-GNU_CONFIGURE= yes
	-GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
	-CONFIGURE_ARGS= --docdir=${DOCSDIR} \
	- --without-doxygen
	-MAKE_ARGS= examplesdir=${EXAMPLESDIR} \
	- pkgdatadir=${DATADIR}
	-
	-CONFLICTS= kyua-atf-compat kyua-cli kyua-testers
	-
	-SUB_FILES= kyua.conf
	-_TESTS_USER= tests
	-SUB_LIST= TESTS_USER=${_TESTS_USER}
	-USERS= ${_TESTS_USER}
	-GROUPS= tests
	-
	-OPTIONS_DEFINE= DOCS EXAMPLES TEST
	-OPTIONS_DEFAULT= TEST
	-OPTIONS_SUB= yes
	-
	-DOCS_MAKE_ARGS_OFF= doc_DATA=
	-EXAMPLES_MAKE_ARGS_OFF= dist_examples_DATA=
	-TEST_BUILD_DEPENDS= atf>=0.21:devel/atf
	-TEST_RUN_DEPENDS= atf>=0.21:devel/atf
	-TEST_CONFIGURE_ENABLE= atf
	-
	-# TODO: Get back to IGNORE after the alignment with the dependent ports
	-#.if ${OPSYS} == FreeBSD && ${OSREL:R} >= 14
	-#IGNORE= kyua from base must be used for FreeBSD 14.x and newer
	-#.endif
	-
	-post-install:
	- @${MKDIR} ${STAGEDIR}${PREFIX}/etc/kyua
	- ${INSTALL_DATA} ${WRKDIR}/kyua.conf \
	- ${STAGEDIR}${PREFIX}/etc/kyua/kyua.conf.sample
	- ${INSTALL_DATA} ${WRKSRC}/examples/Kyuafile.top \
	- ${STAGEDIR}${PREFIX}/tests/Kyuafile
	-
	-.include <bsd.port.mk>
	diff --git a/devel/kyua/distinfo b/devel/kyua/distinfo
	deleted file mode 100644
	--- a/devel/kyua/distinfo
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-TIMESTAMP = 1743284768
	-SHA256 (kyua-0.14.1.tar.gz) = 3caf30a7e316f4f21c32e1c419ec80371fe113e3eed10ba1db9e6efc7ee15ecb
	-SIZE (kyua-0.14.1.tar.gz) = 996797
	diff --git a/devel/kyua/files/kyua.conf.in b/devel/kyua/files/kyua.conf.in
	deleted file mode 100644
	--- a/devel/kyua/files/kyua.conf.in
	+++ /dev/null
	@@ -1,12 +0,0 @@
	--- System-wide configuration file for kyua(1). See kyua.conf(5) for details
	--- on the syntax.
	---
	-
	-syntax(2)
	-
	--- User to drop privileges to when invoking kyua(1) as root and a test case
	--- requests to be run with non-root permissions.
	-unprivileged_user = '%%TESTS_USER%%'
	-
	--- An example to set a configuration property specific to FreeBSD.
	---test_suites.FreeBSD.fstype = 'ffs'
	diff --git a/devel/kyua/pkg-descr b/devel/kyua/pkg-descr
	deleted file mode 100644
	--- a/devel/kyua/pkg-descr
	+++ /dev/null
	@@ -1,16 +0,0 @@
	-Kyua is a testing framework for infrastructure software, originally
	-designed to equip BSD-based operating systems with a test suite. This
	-means that Kyua is lightweight and simple, and that Kyua integrates well
	-with various build systems and continuous integration frameworks.
	-
	-Kyua features an expressive test suite definition language, a safe
	-runtime engine for test suites and a powerful report generation engine.
	-
	-Kyua is for both developers and users, from the developer applying a
	-simple fix to a library to the system administrator deploying a new
	-release on a production machine.
	-
	-Kyua is able to execute test programs written with a plethora of testing
	-libraries and languages. The library of choice is ATF, for which Kyua
	-was originally designed, but simple, framework-less test programs and
	-TAP-compliant test programs can also be executed through Kyua.
	diff --git a/devel/kyua/pkg-message b/devel/kyua/pkg-message
	deleted file mode 100644
	--- a/devel/kyua/pkg-message
	+++ /dev/null
	@@ -1,15 +0,0 @@
	-[
	-{
	- message: <<EOD
	-A tests group has been added and the tests user should be a member
	-of it by default rather than nobody. You should update your password
	-database to match (change the group from 65534 to 977 after updating).
	-
	-To do it, please run the following command:
	-
	-pw usermod -n tests -g tests
	-EOD,
	- type : upgrade,
	- maximum_version: "0.13_5,3"
	-}
	-]
	diff --git a/devel/kyua/pkg-plist b/devel/kyua/pkg-plist
	deleted file mode 100644
	--- a/devel/kyua/pkg-plist
	+++ /dev/null
	@@ -1,193 +0,0 @@
	-bin/kyua
	-@sample etc/kyua/kyua.conf.sample
	-share/man/man1/kyua-about.1.gz
	-share/man/man1/kyua-config.1.gz
	-share/man/man1/kyua-db-exec.1.gz
	-share/man/man1/kyua-db-migrate.1.gz
	-share/man/man1/kyua-debug.1.gz
	-share/man/man1/kyua-help.1.gz
	-share/man/man1/kyua-list.1.gz
	-share/man/man1/kyua-report-html.1.gz
	-share/man/man1/kyua-report-junit.1.gz
	-share/man/man1/kyua-report.1.gz
	-share/man/man1/kyua-test.1.gz
	-share/man/man1/kyua.1.gz
	-share/man/man5/kyua.conf.5.gz
	-share/man/man5/kyuafile.5.gz
	-%%DATADIR%%/misc/context.html
	-%%DATADIR%%/misc/index.html
	-%%DATADIR%%/misc/report.css
	-%%DATADIR%%/misc/test_result.html
	-%%DATADIR%%/store/migrate_v1_v2.sql
	-%%DATADIR%%/store/migrate_v2_v3.sql
	-%%DATADIR%%/store/schema_v3.sql
	-%%PORTDOCS%%%%DOCSDIR%%/AUTHORS
	-%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTING.md
	-%%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTORS
	-%%PORTDOCS%%%%DOCSDIR%%/LICENSE
	-%%PORTDOCS%%%%DOCSDIR%%/NEWS
	-%%PORTEXAMPLES%%%%EXAMPLESDIR%%/Kyuafile.top
	-%%PORTEXAMPLES%%%%EXAMPLESDIR%%/kyua.conf
	-%%TEST%%tests/Kyuafile
	-%%TEST%%tests/kyua/Kyuafile
	-%%TEST%%tests/kyua/bootstrap/Kyuafile
	-%%TEST%%tests/kyua/bootstrap/atf_helpers
	-%%TEST%%tests/kyua/bootstrap/plain_helpers
	-%%TEST%%tests/kyua/bootstrap/testsuite
	-%%TEST%%tests/kyua/cli/Kyuafile
	-%%TEST%%tests/kyua/cli/cmd_about_test
	-%%TEST%%tests/kyua/cli/cmd_config_test
	-%%TEST%%tests/kyua/cli/cmd_db_exec_test
	-%%TEST%%tests/kyua/cli/cmd_debug_test
	-%%TEST%%tests/kyua/cli/cmd_help_test
	-%%TEST%%tests/kyua/cli/cmd_list_test
	-%%TEST%%tests/kyua/cli/cmd_test_test
	-%%TEST%%tests/kyua/cli/common_test
	-%%TEST%%tests/kyua/cli/config_test
	-%%TEST%%tests/kyua/cli/main_test
	-%%TEST%%tests/kyua/drivers/Kyuafile
	-%%TEST%%tests/kyua/drivers/list_tests_helpers
	-%%TEST%%tests/kyua/drivers/list_tests_test
	-%%TEST%%tests/kyua/drivers/report_junit_test
	-%%TEST%%tests/kyua/drivers/scan_results_test
	-%%TEST%%tests/kyua/engine/Kyuafile
	-%%TEST%%tests/kyua/engine/atf_helpers
	-%%TEST%%tests/kyua/engine/atf_list_test
	-%%TEST%%tests/kyua/engine/atf_result_test
	-%%TEST%%tests/kyua/engine/atf_test
	-%%TEST%%tests/kyua/engine/config_test
	-%%TEST%%tests/kyua/engine/exceptions_test
	-%%TEST%%tests/kyua/engine/filters_test
	-%%TEST%%tests/kyua/engine/kyuafile_test
	-%%TEST%%tests/kyua/engine/plain_helpers
	-%%TEST%%tests/kyua/engine/plain_test
	-%%TEST%%tests/kyua/engine/scanner_test
	-%%TEST%%tests/kyua/engine/scheduler_test
	-%%TEST%%tests/kyua/engine/requirements_test
	-%%TEST%%tests/kyua/engine/tap_helpers
	-%%TEST%%tests/kyua/engine/tap_parser_test
	-%%TEST%%tests/kyua/engine/tap_test
	-%%TEST%%tests/kyua/examples/Kyuafile
	-%%TEST%%tests/kyua/examples/syntax_test
	-%%TEST%%tests/kyua/integration/Kyuafile
	-%%TEST%%tests/kyua/integration/cmd_about_test
	-%%TEST%%tests/kyua/integration/cmd_config_test
	-%%TEST%%tests/kyua/integration/cmd_db_exec_test
	-%%TEST%%tests/kyua/integration/cmd_db_migrate_test
	-%%TEST%%tests/kyua/integration/cmd_debug_test
	-%%TEST%%tests/kyua/integration/cmd_help_test
	-%%TEST%%tests/kyua/integration/cmd_list_test
	-%%TEST%%tests/kyua/integration/cmd_report_html_test
	-%%TEST%%tests/kyua/integration/cmd_report_junit_test
	-%%TEST%%tests/kyua/integration/cmd_report_test
	-%%TEST%%tests/kyua/integration/cmd_test_test
	-%%TEST%%tests/kyua/integration/global_test
	-%%TEST%%tests/kyua/integration/helpers/bad_test_program
	-%%TEST%%tests/kyua/integration/helpers/bogus_test_cases
	-%%TEST%%tests/kyua/integration/helpers/config
	-%%TEST%%tests/kyua/integration/helpers/dump_env
	-%%TEST%%tests/kyua/integration/helpers/expect_all_pass
	-%%TEST%%tests/kyua/integration/helpers/expect_some_fail
	-%%TEST%%tests/kyua/integration/helpers/interrupts
	-%%TEST%%tests/kyua/integration/helpers/metadata
	-%%TEST%%tests/kyua/integration/helpers/race
	-%%TEST%%tests/kyua/integration/helpers/simple_all_pass
	-%%TEST%%tests/kyua/integration/helpers/simple_some_fail
	-%%TEST%%tests/kyua/model/Kyuafile
	-%%TEST%%tests/kyua/model/context_test
	-%%TEST%%tests/kyua/model/exceptions_test
	-%%TEST%%tests/kyua/model/metadata_test
	-%%TEST%%tests/kyua/model/test_case_test
	-%%TEST%%tests/kyua/model/test_program_test
	-%%TEST%%tests/kyua/model/test_result_test
	-%%TEST%%tests/kyua/store/Kyuafile
	-%%TEST%%tests/kyua/store/dbtypes_test
	-%%TEST%%tests/kyua/store/exceptions_test
	-%%TEST%%tests/kyua/store/layout_test
	-%%TEST%%tests/kyua/store/metadata_test
	-%%TEST%%tests/kyua/store/migrate_test
	-%%TEST%%tests/kyua/store/read_backend_test
	-%%TEST%%tests/kyua/store/read_transaction_test
	-%%TEST%%tests/kyua/store/schema_inttest
	-%%TEST%%tests/kyua/store/schema_v1.sql
	-%%TEST%%tests/kyua/store/schema_v2.sql
	-%%TEST%%tests/kyua/store/testdata_v1.sql
	-%%TEST%%tests/kyua/store/testdata_v2.sql
	-%%TEST%%tests/kyua/store/testdata_v3_1.sql
	-%%TEST%%tests/kyua/store/testdata_v3_2.sql
	-%%TEST%%tests/kyua/store/testdata_v3_3.sql
	-%%TEST%%tests/kyua/store/testdata_v3_4.sql
	-%%TEST%%tests/kyua/store/transaction_test
	-%%TEST%%tests/kyua/store/write_backend_test
	-%%TEST%%tests/kyua/store/write_transaction_test
	-%%TEST%%tests/kyua/utils/Kyuafile
	-%%TEST%%tests/kyua/utils/auto_array_test
	-%%TEST%%tests/kyua/utils/cmdline/Kyuafile
	-%%TEST%%tests/kyua/utils/cmdline/base_command_test
	-%%TEST%%tests/kyua/utils/cmdline/commands_map_test
	-%%TEST%%tests/kyua/utils/cmdline/exceptions_test
	-%%TEST%%tests/kyua/utils/cmdline/globals_test
	-%%TEST%%tests/kyua/utils/cmdline/options_test
	-%%TEST%%tests/kyua/utils/cmdline/parser_test
	-%%TEST%%tests/kyua/utils/cmdline/ui_test
	-%%TEST%%tests/kyua/utils/config/Kyuafile
	-%%TEST%%tests/kyua/utils/config/exceptions_test
	-%%TEST%%tests/kyua/utils/config/keys_test
	-%%TEST%%tests/kyua/utils/config/lua_module_test
	-%%TEST%%tests/kyua/utils/config/nodes_test
	-%%TEST%%tests/kyua/utils/config/parser_test
	-%%TEST%%tests/kyua/utils/config/tree_test
	-%%TEST%%tests/kyua/utils/datetime_test
	-%%TEST%%tests/kyua/utils/env_test
	-%%TEST%%tests/kyua/utils/format/Kyuafile
	-%%TEST%%tests/kyua/utils/format/containers_test
	-%%TEST%%tests/kyua/utils/format/exceptions_test
	-%%TEST%%tests/kyua/utils/format/formatter_test
	-%%TEST%%tests/kyua/utils/fs/Kyuafile
	-%%TEST%%tests/kyua/utils/fs/auto_cleaners_test
	-%%TEST%%tests/kyua/utils/fs/directory_test
	-%%TEST%%tests/kyua/utils/fs/exceptions_test
	-%%TEST%%tests/kyua/utils/fs/lua_module_test
	-%%TEST%%tests/kyua/utils/fs/operations_test
	-%%TEST%%tests/kyua/utils/fs/path_test
	-%%TEST%%tests/kyua/utils/logging/Kyuafile
	-%%TEST%%tests/kyua/utils/logging/macros_test
	-%%TEST%%tests/kyua/utils/logging/operations_test
	-%%TEST%%tests/kyua/utils/memory_test
	-%%TEST%%tests/kyua/utils/optional_test
	-%%TEST%%tests/kyua/utils/passwd_test
	-%%TEST%%tests/kyua/utils/process/Kyuafile
	-%%TEST%%tests/kyua/utils/process/child_test
	-%%TEST%%tests/kyua/utils/process/deadline_killer_test
	-%%TEST%%tests/kyua/utils/process/exceptions_test
	-%%TEST%%tests/kyua/utils/process/executor_pid_test
	-%%TEST%%tests/kyua/utils/process/executor_test
	-%%TEST%%tests/kyua/utils/process/fdstream_test
	-%%TEST%%tests/kyua/utils/process/helpers
	-%%TEST%%tests/kyua/utils/process/isolation_test
	-%%TEST%%tests/kyua/utils/process/operations_test
	-%%TEST%%tests/kyua/utils/process/status_test
	-%%TEST%%tests/kyua/utils/process/systembuf_test
	-%%TEST%%tests/kyua/utils/sanity_test
	-%%TEST%%tests/kyua/utils/signals/Kyuafile
	-%%TEST%%tests/kyua/utils/signals/exceptions_test
	-%%TEST%%tests/kyua/utils/signals/interrupts_test
	-%%TEST%%tests/kyua/utils/signals/misc_test
	-%%TEST%%tests/kyua/utils/signals/programmer_test
	-%%TEST%%tests/kyua/utils/signals/timer_test
	-%%TEST%%tests/kyua/utils/sqlite/Kyuafile
	-%%TEST%%tests/kyua/utils/sqlite/c_gate_test
	-%%TEST%%tests/kyua/utils/sqlite/database_test
	-%%TEST%%tests/kyua/utils/sqlite/exceptions_test
	-%%TEST%%tests/kyua/utils/sqlite/statement_test
	-%%TEST%%tests/kyua/utils/sqlite/transaction_test
	-%%TEST%%tests/kyua/utils/stacktrace_helper
	-%%TEST%%tests/kyua/utils/stacktrace_test
	-%%TEST%%tests/kyua/utils/stream_test
	-%%TEST%%tests/kyua/utils/text/Kyuafile
	-%%TEST%%tests/kyua/utils/text/exceptions_test
	-%%TEST%%tests/kyua/utils/text/operations_test
	-%%TEST%%tests/kyua/utils/text/regex_test
	-%%TEST%%tests/kyua/utils/text/table_test
	-%%TEST%%tests/kyua/utils/text/templates_test
	-%%TEST%%tests/kyua/utils/units_test
	diff --git a/devel/libdistance/Makefile b/devel/libdistance/Makefile
	--- a/devel/libdistance/Makefile
	+++ b/devel/libdistance/Makefile
	@@ -23,7 +23,7 @@

	.include <bsd.port.options.mk>

	-.if defined(NOPROFILE) \|\| defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
	+.if defined(NOPROFILE) \|\| defined(NO_PROFILE) \|\| ${OPSYS} == FreeBSD
	PLIST_SUB+= PROFILE="@comment "
	.else
	PLIST_SUB+= PROFILE=""
	diff --git a/devel/libhoard/Makefile b/devel/libhoard/Makefile
	--- a/devel/libhoard/Makefile
	+++ b/devel/libhoard/Makefile
	@@ -12,9 +12,6 @@
	LICENSE= GPLv2+
	LICENSE_FILE= ${WRKSRC}/../COPYING

	-BROKEN_mips= no spin lock implementation is available for this platform
	-BROKEN_mips64= no spin lock implementation is available for this platform
	-
	WRKSRC= ${WRKDIR}/Hoard/src
	MAKEFILE= GNUmakefile
	USES= gmake compiler:c++14-lang
	diff --git a/devel/libmtrie/Makefile b/devel/libmtrie/Makefile
	--- a/devel/libmtrie/Makefile
	+++ b/devel/libmtrie/Makefile
	@@ -14,7 +14,7 @@

	.include <bsd.port.pre.mk>

	-.if defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
	+.if defined(NO_PROFILE) \|\| ${OPSYS} == FreeBSD
	PLIST_SUB+= HURRRR="@comment "
	.else
	PLIST_SUB+= HURRRR=""
	diff --git a/devel/libruin/Makefile b/devel/libruin/Makefile
	--- a/devel/libruin/Makefile
	+++ b/devel/libruin/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= GPLv3+
	LICENSE_FILE= ${WRKSRC}/COPYING

	-NOT_FOR_ARCHS= mips
	-NOT_FOR_ARCHS_REASON= glib needs GCC (not available for mips)
	-
	BUILD_DEPENDS= guile-lib-${GUILE_FLAVOR}>0:devel/guile-lib@${GUILE_FLAVOR}
	RUN_DEPENDS= guile-lib-${GUILE_FLAVOR}>0:devel/guile-lib@${GUILE_FLAVOR}

	diff --git a/devel/libvex/Makefile b/devel/libvex/Makefile
	--- a/devel/libvex/Makefile
	+++ b/devel/libvex/Makefile
	@@ -21,7 +21,7 @@

	MAKEFILE= Makefile-gcc

	-CFLAGS+= -DVGA_${ARCH:S/i386/x86/:S/aarch64/arm/:S/powerpc64le/ppc64le/:S/powerpc64/ppc64/:S/powerpc/ppc32/:S/mips/mips64/}
	+CFLAGS+= -DVGA_${ARCH:S/i386/x86/:S/aarch64/arm/:S/powerpc64le/ppc64le/:S/powerpc64/ppc64/:S/powerpc/ppc32/}

	MAKE_ARGS= EXTRA_CFLAGS="${CFLAGS}"

	diff --git a/devel/lightning/Makefile b/devel/lightning/Makefile
	--- a/devel/lightning/Makefile
	+++ b/devel/lightning/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= LGPL3+
	LICENSE_FILE= ${WRKSRC}/COPYING.LESSER

	-ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 mips powerpc powerpc64 powerpc64le powerpcspe riscv64
	+ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 powerpc powerpc64 powerpc64le powerpcspe riscv64

	USES= cpe libtool pathfix
	CPE_VENDOR= gnu
	diff --git a/devel/llvm-cheri/Makefile b/devel/llvm-cheri/Makefile
	--- a/devel/llvm-cheri/Makefile
	+++ b/devel/llvm-cheri/Makefile
	@@ -10,7 +10,7 @@

	.include "${.PARSEDIR}/../llvm-devel/Makefile.LICENSE"

	-NOT_FOR_ARCHS= i386 armv6 armv7 powerpc mips
	+NOT_FOR_ARCHS= i386 armv6 armv7 powerpc
	NOT_FOR_ARCHS_REASON= No one will develop CHERI from 32-bit

	LLVM_SUFFIX?= -cheri
	diff --git a/devel/llvm-cheriot/Makefile b/devel/llvm-cheriot/Makefile
	--- a/devel/llvm-cheriot/Makefile
	+++ b/devel/llvm-cheriot/Makefile
	@@ -11,7 +11,7 @@

	.include "${.PARSEDIR}/../llvm-devel/Makefile.LICENSE"

	-NOT_FOR_ARCHS= i386 armv6 armv7 powerpc mips
	+NOT_FOR_ARCHS= i386 armv6 armv7 powerpc
	NOT_FOR_ARCHS_REASON= No one will develop CHERI from 32-bit

	LLVM_SUFFIX= -cheriot
	diff --git a/devel/llvm12/Makefile b/devel/llvm12/Makefile
	--- a/devel/llvm12/Makefile
	+++ b/devel/llvm12/Makefile
	@@ -264,7 +264,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -274,8 +274,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm13/Makefile b/devel/llvm13/Makefile
	--- a/devel/llvm13/Makefile
	+++ b/devel/llvm13/Makefile
	@@ -301,7 +301,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -311,8 +311,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm14/Makefile b/devel/llvm14/Makefile
	--- a/devel/llvm14/Makefile
	+++ b/devel/llvm14/Makefile
	@@ -302,7 +302,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -312,8 +312,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm15/Makefile b/devel/llvm15/Makefile
	--- a/devel/llvm15/Makefile
	+++ b/devel/llvm15/Makefile
	@@ -324,7 +324,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -334,8 +334,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm16/Makefile b/devel/llvm16/Makefile
	--- a/devel/llvm16/Makefile
	+++ b/devel/llvm16/Makefile
	@@ -330,7 +330,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -340,8 +340,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm17/Makefile b/devel/llvm17/Makefile
	--- a/devel/llvm17/Makefile
	+++ b/devel/llvm17/Makefile
	@@ -334,7 +334,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -344,8 +344,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm18/Makefile b/devel/llvm18/Makefile
	--- a/devel/llvm18/Makefile
	+++ b/devel/llvm18/Makefile
	@@ -338,7 +338,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -348,8 +348,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm19/Makefile b/devel/llvm19/Makefile
	--- a/devel/llvm19/Makefile
	+++ b/devel/llvm19/Makefile
	@@ -355,7 +355,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -365,8 +365,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm20/Makefile b/devel/llvm20/Makefile
	--- a/devel/llvm20/Makefile
	+++ b/devel/llvm20/Makefile
	@@ -361,7 +361,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -371,8 +371,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm21/Makefile b/devel/llvm21/Makefile
	--- a/devel/llvm21/Makefile
	+++ b/devel/llvm21/Makefile
	@@ -361,7 +361,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -371,8 +371,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/llvm22/Makefile b/devel/llvm22/Makefile
	--- a/devel/llvm22/Makefile
	+++ b/devel/llvm22/Makefile
	@@ -361,7 +361,7 @@
	.include "${.CURDIR}/Makefile.COMMANDS"
	.include "${.CURDIR}/Makefile.MAN1SRCS"

	-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
	+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
	FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
	.if ${ARCH} == amd64
	_NATIVE_BACKENDS= X86
	@@ -371,8 +371,6 @@
	_NATIVE_BACKENDS= ARM
	.elif ${ARCH} == i386
	_NATIVE_BACKENDS= X86
	-.elif ${ARCH:Mmips*}
	-_NATIVE_BACKENDS= Mips
	.elif ${ARCH:Mpowerpc*}
	_NATIVE_BACKENDS= PowerPC
	.elif ${ARCH:Mriscv*}
	diff --git a/devel/love/Makefile b/devel/love/Makefile
	--- a/devel/love/Makefile
	+++ b/devel/love/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= ZLIB
	LICENSE_FILE= ${WRKSRC}/license.txt

	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= Hashing not yet implemented for big endian

	LIB_DEPENDS= libmodplug.so:audio/libmodplug \
	diff --git a/devel/mongo-c-driver/Makefile b/devel/mongo-c-driver/Makefile
	--- a/devel/mongo-c-driver/Makefile
	+++ b/devel/mongo-c-driver/Makefile
	@@ -85,7 +85,7 @@
	CMAKE_ARGS+= -DENABLE_SSL=LIBRESSL
	.endif
	CMAKE_ARGS+= -DENABLE_SSL=OPENSSL
	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CFLAGS+= -DOPENSSL_API_COMPAT=0x30000000L
	.endif
	.endif
	diff --git a/devel/notcurses/Makefile b/devel/notcurses/Makefile
	--- a/devel/notcurses/Makefile
	+++ b/devel/notcurses/Makefile
	@@ -18,7 +18,7 @@
	libqrcodegen.so:graphics/qr-code-generator \
	libunistring.so:devel/libunistring

	-USES= cmake:noninja compiler:c++17-lang localbase pkgconfig
	+USES= cmake:noninja compiler:c++17-lang localbase ncurses pkgconfig
	USE_GITHUB= yes
	GH_ACCOUNT= dankamongmen
	USE_LDCONFIG= yes
	@@ -39,15 +39,6 @@

	ABIVERSION= 3

	-.include <bsd.port.options.mk>
	-
	-# ncursesw and tinfo >= 6.1 seem to be needed (see CMakeLists.txt:l104)
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400035
	-USES+=ncurses:port
	-.else
	-USES+=ncurses
	-.endif
	-
	post-patch-DOCS-off:
	@${REINPLACE_CMD} -e 's\|install(FILES $${MARKDOWN} DESTINATION $${CMAKE_INSTALL_DOCDIR})\|#install(FILES $${MARKDOWN} DESTINATION $${CMAKE_INSTALL_DOCDIR})\|' \
	${WRKSRC}/CMakeLists.txt
	diff --git a/devel/objconv/Makefile b/devel/objconv/Makefile
	--- a/devel/objconv/Makefile
	+++ b/devel/objconv/Makefile
	@@ -10,7 +10,7 @@

	LICENSE= GPLv1

	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= source/maindef.h:71:5: This machine has big-endian memory organization. Objconv program will not work

	USES= dos2unix zip
	diff --git a/devel/ocaml-extlib/Makefile b/devel/ocaml-extlib/Makefile
	--- a/devel/ocaml-extlib/Makefile
	+++ b/devel/ocaml-extlib/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= LGPL21
	LICENSE_FILE= ${WRKSRC}/../LICENSE

	-BROKEN_mips= depends on Ocaml(not available for mips)
	-
	BUILD_DEPENDS= cppo:devel/ocaml-cppo

	USES= gmake ocaml:camlp4,findplist
	diff --git a/devel/p5-Data-MessagePack-Stream/Makefile b/devel/p5-Data-MessagePack-Stream/Makefile
	--- a/devel/p5-Data-MessagePack-Stream/Makefile
	+++ b/devel/p5-Data-MessagePack-Stream/Makefile
	@@ -8,9 +8,6 @@
	COMMENT= Perl extension for yet another messagepack streaming deserializer
	WWW= https://metacpan.org/release/Data-MessagePack-Stream

	-BROKEN_mips= fails to build: atomic operations are not found
	-BROKEN_mips64= fails to build: atomic operations are not found
	-
	BUILD_DEPENDS= p5-File-Which>=0:sysutils/p5-File-Which \
	p5-Module-Build-XSUtil>=0:devel/p5-Module-Build-XSUtil \
	${RUN_DEPENDS}
	diff --git a/devel/pcre/Makefile b/devel/pcre/Makefile
	--- a/devel/pcre/Makefile
	+++ b/devel/pcre/Makefile
	@@ -38,7 +38,6 @@
	OPTIONS_DEFAULT_aarch64+= JIT
	OPTIONS_DEFAULT_amd64+= JIT
	OPTIONS_DEFAULT_i386+= JIT
	-OPTIONS_DEFAULT_mips+= JIT
	OPTIONS_DEFAULT_powerpc=JIT
	OPTIONS_DEFAULT_powerpc64= JIT
	OPTIONS_DEFAULT_powerpc64le= JIT
	diff --git a/devel/pcre2/Makefile b/devel/pcre2/Makefile
	--- a/devel/pcre2/Makefile
	+++ b/devel/pcre2/Makefile
	@@ -48,7 +48,7 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH:Mmips64} == "" && ${ARCH:Mriscv64} == ""
	+.if ${ARCH:Mriscv64*} == ""
	CMAKE_ON+= PCRE2_SUPPORT_JIT
	.else
	CMAKE_OFF+= PCRE2_SUPPORT_JIT
	diff --git a/devel/pecl-grpc/Makefile b/devel/pecl-grpc/Makefile
	--- a/devel/pecl-grpc/Makefile
	+++ b/devel/pecl-grpc/Makefile
	@@ -9,9 +9,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_mips= fails to compile: fatal error: sys/auxv.h file not found
	-BROKEN_mips64= fails to compile: fatal error: sys/auxv.h file not found
	-
	USES= compiler:c++11-lang php:pecl

	.include <bsd.port.mk>
	diff --git a/devel/pickle/Makefile b/devel/pickle/Makefile
	--- a/devel/pickle/Makefile
	+++ b/devel/pickle/Makefile
	@@ -12,8 +12,6 @@

	BROKEN_armv6= invokes x86 assembler
	BROKEN_armv7= invokes x86 assembler
	-BROKEN_mips= invokes x86 assembler
	-BROKEN_mips64= invokes x86 assembler

	USES= gmake tar:tgz

	diff --git a/devel/pkgconf/Makefile b/devel/pkgconf/Makefile
	--- a/devel/pkgconf/Makefile
	+++ b/devel/pkgconf/Makefile
	@@ -13,8 +13,6 @@

	LICENSE= ISCL

	-TEST_DEPENDS= kyua:devel/kyua
	-
	USES= cpe tar:xz libtool pathfix
	GNU_CONFIGURE= yes
	GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
	diff --git a/devel/py-greenlet/Makefile b/devel/py-greenlet/Makefile
	--- a/devel/py-greenlet/Makefile
	+++ b/devel/py-greenlet/Makefile
	@@ -14,9 +14,6 @@
	LICENSE_FILE_MIT= ${WRKSRC}/LICENSE
	LICENSE_FILE_PSFL= ${WRKSRC}/LICENSE.PSF

	-NOT_FOR_ARCHS= mips mips64
	-NOT_FOR_ARCHS_REASON= greenlet needs to be ported to this platform
	-
	BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}setuptools>=61:devel/py-setuptools@${PY_FLAVOR} \
	${PYTHON_PKGNAMEPREFIX}wheel>=0:devel/py-wheel@${PY_FLAVOR}

	diff --git a/devel/radare2/Makefile b/devel/radare2/Makefile
	--- a/devel/radare2/Makefile
	+++ b/devel/radare2/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/COPYING

	-NOT_FOR_ARCHS= armv6 armv7 mips mips64 powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 powerpcspe
	NOT_FOR_ARCHS_REASON= does not build: Unsupported BSD architecture

	LIB_DEPENDS= libcapstone.so:devel/capstone
	diff --git a/devel/skalibs/Makefile b/devel/skalibs/Makefile
	--- a/devel/skalibs/Makefile
	+++ b/devel/skalibs/Makefile
	@@ -10,8 +10,6 @@
	LICENSE= ISCL
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips64= fails to build: Checking whether system has auto-close after fd-passing... test crashed, aborting
	-
	USES= gmake
	USE_LDCONFIG= yes
	HAS_CONFIGURE= yes
	diff --git a/devel/tex-libtexluajit/Makefile b/devel/tex-libtexluajit/Makefile
	--- a/devel/tex-libtexluajit/Makefile
	+++ b/devel/tex-libtexluajit/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LuaJIT-src/COPYRIGHT

	-BROKEN_mips= Does not configure: error: Sorry, cannot preprocess lj_arch.h
	-BROKEN_mips64= Does not configure: error: Sorry, cannot preprocess lj_arch.h
	BROKEN_powerpc64= Does not build: uninitialized constant Config (NameError)
	BROKEN_riscv64= Does not configure: error: Sorry, cannot preprocess lj_arch.h

	diff --git a/dns/dnsdist/Makefile b/dns/dnsdist/Makefile
	--- a/dns/dnsdist/Makefile
	+++ b/dns/dnsdist/Makefile
	@@ -99,20 +99,12 @@

	OPENSSL_USES= ssl
	OPENSSL_MESON_ENABLED= libcrypto tls-libssl
	-OPENSSL_MESON_ON= -Dlibcrypto-path=${OPENSSLBASE}
	+OPENSSL_MESON_ON= -Dlibcrypto-path=${OPENSSLBASE} -Dtls-libssl-engines=true

	SNMP_LIB_DEPENDS= libnetsnmp.so:net-mgmt/net-snmp
	SNMP_MESON_ENABLED= snmp

	-.include <bsd.port.pre.mk>
	-
	-.if !(${OSVERSION} < 1400000 && ${SSL_DEFAULT} == "base")
	-OPENSSL_MESON_ON+= -Dtls-libssl-providers=true
	-.else
	-OPENSSL_MESON_ON+= -Dtls-libssl-engines=true
	-.endif
	-
	post-install:
	${MV} ${STAGEDIR}${ETCDIR}/dnsdist.conf-dist ${STAGEDIR}${ETCDIR}/dnsdist.conf.sample

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/dns/dog/Makefile b/dns/dog/Makefile
	--- a/dns/dog/Makefile
	+++ b/dns/dog/Makefile
	@@ -105,7 +105,7 @@

	.include <bsd.port.options.mk>

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl} \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl} \|\| ${SSL_DEFAULT:Mopenssl3*}
	BROKEN= Fails to detect OpenSSL 3.0.0 and later
	.endif

	diff --git a/editors/libreoffice/Makefile b/editors/libreoffice/Makefile
	--- a/editors/libreoffice/Makefile
	+++ b/editors/libreoffice/Makefile
	@@ -366,11 +366,6 @@

	.include <bsd.port.pre.mk>

	-.if ${OPSYS} == FreeBSD && ( \
	- (${OSVERSION} >= 1400051 && ${OSVERSION} < 1400057))
	-BROKEN= please update FreeBSD base system first to fix an ABI incompatibility
	-.endif
	-
	.if ${ARCH} == powerpc \|\| ${ARCH} == powerpcspe \|\| ${ARCH} == powerpc64
	CONFIGURE_ARGS+= --disable-skia
	.endif
	diff --git a/emulators/mesen/Makefile b/emulators/mesen/Makefile
	--- a/emulators/mesen/Makefile
	+++ b/emulators/mesen/Makefile
	@@ -8,7 +8,7 @@

	LICENSE= GPLv3

	-# ARM/MIPS are only supported on Android
	+# ARM is only supported on Android
	ONLY_FOR_ARCHS= amd64 i386

	BUILD_DEPENDS= zip:archivers/zip \
	diff --git a/emulators/ppsspp/Makefile b/emulators/ppsspp/Makefile
	--- a/emulators/ppsspp/Makefile
	+++ b/emulators/ppsspp/Makefile
	@@ -13,7 +13,7 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE.TXT

	# Bi-endian architectures default to big for some reason
	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= only little-endian is supported, see \
	https://github.com/hrydgard/ppsspp/issues/8823

	diff --git a/filesystems/fusefs-libs3/files/extra-patch-test_meson.build b/filesystems/fusefs-libs3/files/extra-patch-test_meson.build
	deleted file mode 100644
	--- a/filesystems/fusefs-libs3/files/extra-patch-test_meson.build
	+++ /dev/null
	@@ -1,15 +0,0 @@
	---- test/meson.build.orig 2021-09-06 12:45:29 UTC
	-+++ test/meson.build
	-@@ -7,9 +7,9 @@ foreach prog: [ 'test_write_cache', 'test_setattr' ]
	- dependencies: thread_dep,
	- install: false)
	- endforeach
	--td += executable('test_syscalls', 'test_syscalls.c',
	-- include_directories: include_dirs,
	-- install: false)
	-+#td += executable('test_syscalls', 'test_syscalls.c',
	-+# include_directories: include_dirs,
	-+# install: false)
	- td += executable('readdir_inode', 'readdir_inode.c',
	- include_directories: include_dirs,
	- install: false)
	diff --git a/filesystems/py-libzfs/Makefile b/filesystems/py-libzfs/Makefile
	--- a/filesystems/py-libzfs/Makefile
	+++ b/filesystems/py-libzfs/Makefile
	@@ -32,11 +32,8 @@
	IGNORE= requires kernel source files in ${SRC_BASE}
	.endif

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400000
	+.if ${OPSYS} == FreeBSD
	PATCHFILES+= 0b2ab0594997c44e80e3fdfe9d2add106d81149a.diff:-p1 # backport of https://github.com/truenas/py-libzfs/pull/251
	-.endif
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1401000
	EXTRA_PATCHES+= ${FILESDIR}/extra-zpool-add.patch
	.endif

	diff --git a/finance/fabric/Makefile b/finance/fabric/Makefile
	--- a/finance/fabric/Makefile
	+++ b/finance/fabric/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # compilation fails on non-64-bit systems: fabric-amcl/core/FP256BN/FP.go:111:19: cannot convert MConst (constant 30564559323915749 of type Chunk) to type int
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # compilation fails on non-64-bit systems: fabric-amcl/core/FP256BN/FP.go:111:19: cannot convert MConst (constant 30564559323915749 of type Chunk) to type int

	USES= go:modules
	USE_GITHUB= yes
	diff --git a/french/aster/Makefile b/french/aster/Makefile
	--- a/french/aster/Makefile
	+++ b/french/aster/Makefile
	@@ -9,7 +9,7 @@

	LICENSE= GPLv2

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
	NOT_FOR_ARCHS_REASON= ARG_MAX is too small for Code_Aster on 32 bits systems

	BROKEN= fails to build the catalog of elements
	diff --git a/ftp/curl/Makefile b/ftp/curl/Makefile
	--- a/ftp/curl/Makefile
	+++ b/ftp/curl/Makefile
	@@ -57,12 +57,7 @@
	OPTIONS_RADIO_SSL= GNUTLS OPENSSL WOLFSSL
	OPTIONS_SINGLE_GSSAPI= GSSAPI_MIT GSSAPI_NONE # GSSAPI_BASE
	OPTIONS_SINGLE_RESOLV= CARES THREADED_RESOLVER
	-#OPTIONS_DEFAULT=ALTSVC BROTLI COOKIES GSSAPI_NONE DICT FTP GOPHER HTTP HTTP2 IDN IMAP IPFS LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMB SMTP STATIC TELNET TFTP THREADED_RESOLVER TLS_SRP WEBSOCKET ZSTD
	-OPTIONS_DEFAULT=ALTSVC BROTLI COOKIES GSSAPI_NONE DICT FTP GOPHER HTTP HTTP2 IDN IMAP IPFS MQTT NTLM POP3 PROXY PSL RTSP SMB SMTP STATIC TELNET TFTP THREADED_RESOLVER WEBSOCKET ZSTD ${OPTIONS_DEFAULT_${OSREL:R}}
	-OPTIONS_DEFAULT_13= WOLFSSL
	-OPTIONS_DEFAULT_14= LIBSSH2 OPENSSL TLS_SRP
	-OPTIONS_DEFAULT_15= LIBSSH2 OPENSSL TLS_SRP
	-OPTIONS_DEFAULT_16= LIBSSH2 OPENSSL TLS_SRP
	+OPTIONS_DEFAULT=ALTSVC BROTLI COOKIES GSSAPI_NONE DICT FTP GOPHER HTTP HTTP2 IDN IMAP IPFS LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMB SMTP STATIC TELNET TFTP THREADED_RESOLVER TLS_SRP WEBSOCKET ZSTD
	OPTIONS_SUB= yes
	ALTSVC_DESC= HTTP Alternative Services support
	COMPRESSION_DESC= Compression methods
	diff --git a/ftp/fastdfs/Makefile b/ftp/fastdfs/Makefile
	--- a/ftp/fastdfs/Makefile
	+++ b/ftp/fastdfs/Makefile
	@@ -10,9 +10,6 @@
	LICENSE= GPLv3+
	LICENSE_FILE= ${WRKSRC}/COPYING-3_0.txt

	-BROKEN_mips= fails to link: tracker_service.c:270: undefined reference to '__sync_add_and_fetch_4'
	-BROKEN_mips64= fails to link: tracker_service.c:270: undefined reference to '__sync_add_and_fetch_4'
	-
	LIB_DEPENDS= libfastcommon.so:devel/libfastcommon

	USES= perl5
	diff --git a/games/anki/Makefile b/games/anki/Makefile
	--- a/games/anki/Makefile
	+++ b/games/anki/Makefile
	@@ -13,7 +13,7 @@
	LICENSE= AGPLv3+
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
	NOT_FOR_ARCHS_REASON= the provided build system written in Rust (= runner) accepts only 64-bit systems.

	BUILD_DEPENDS= protoc:devel/protobuf \
	diff --git a/games/crafty/Makefile b/games/crafty/Makefile
	--- a/games/crafty/Makefile
	+++ b/games/crafty/Makefile
	@@ -17,8 +17,6 @@
	BROKEN_armv6= fails to compile: invokes amd64 assembler
	BROKEN_armv7= fails to compile: invokes amd64 assembler
	BROKEN_i386= fails to compile: invokes amd64 assembler
	-BROKEN_mips= fails to compile: unrecognized command line option "-mpopcnt"
	-BROKEN_mips64= fails to compile: unrecognized command line option "-mpopcnt"
	BROKEN_riscv64= fails to compile: invokes amd64 assembler

	USES= gmake zip
	diff --git a/games/flightgear-data/Makefile b/games/flightgear-data/Makefile
	--- a/games/flightgear-data/Makefile
	+++ b/games/flightgear-data/Makefile
	@@ -10,8 +10,6 @@

	LICENSE= GPLv2

	-BROKEN_mips64= fails to install: runaway process
	-
	USES= tar:txz

	NO_BUILD= yes
	diff --git a/games/freecell-solver/Makefile b/games/freecell-solver/Makefile
	--- a/games/freecell-solver/Makefile
	+++ b/games/freecell-solver/Makefile
	@@ -26,7 +26,6 @@
	LIB_DEPENDS_armv6= libgmp.so:math/gmp
	LIB_DEPENDS_armv7= libgmp.so:math/gmp
	LIB_DEPENDS_i386= libgmp.so:math/gmp
	-LIB_DEPENDS_mips= libgmp.so:math/gmp
	LIB_DEPENDS_powerpc= libgmp.so:math/gmp

	OPTIONS_DEFINE= DOCS TCMALLOC
	diff --git a/games/gcompris-qt/Makefile b/games/gcompris-qt/Makefile
	--- a/games/gcompris-qt/Makefile
	+++ b/games/gcompris-qt/Makefile
	@@ -13,8 +13,6 @@
	LICENSE_FILE_AGPLv3= ${WRKSRC}/LICENSES/AGPL-3.0-only.txt
	LICENSE_FILE_GPLv3= ${WRKSRC}/LICENSES/GPL-3.0-or-later.txt

	-IGNORE_FreeBSD_13= is not supported on systems with OpenSSL 1.1.1
	-
	# libqmlbox2d.so is a QML plugin...don't use LIB_DEPENDS
	BUILD_DEPENDS= ${_BOX2D_PATH}/libqmlbox2d.so:x11-toolkits/qml-box2d \
	${LOCALBASE}/include/vulkan/vulkan.h:graphics/vulkan-headers
	diff --git a/games/lmpc/Makefile b/games/lmpc/Makefile
	--- a/games/lmpc/Makefile
	+++ b/games/lmpc/Makefile
	@@ -12,7 +12,7 @@

	LICENSE= GPLv2+

	-ONLY_FOR_ARCHS= armv6 armv7 i386 mips powerpc
	+ONLY_FOR_ARCHS= armv6 armv7 i386 powerpc
	ONLY_FOR_ARCHS_REASON= assumes sizeof(long) == 4

	USES= gmake perl5 shebangfix
	diff --git a/games/openrct2/Makefile b/games/openrct2/Makefile
	--- a/games/openrct2/Makefile
	+++ b/games/openrct2/Makefile
	@@ -19,7 +19,7 @@
	LICENSE= GPLv3+
	LICENSE_FILE= ${WRKSRC}/licence.txt

	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= Only for little-endian architectures

	BUILD_DEPENDS= nlohmann-json>0:devel/nlohmann-json
	diff --git a/games/regoth/Makefile b/games/regoth/Makefile
	--- a/games/regoth/Makefile
	+++ b/games/regoth/Makefile
	@@ -10,7 +10,6 @@

	LICENSE= GPLv3

	-BROKEN_FreeBSD_13_powerpc64= fails to build: mmintrin.h:33:5: error: use of undeclared identifier '__builtin_ia32_emms'; did you mean '__builtin_isless'?
	BROKEN_riscv64= fails to build: mmintrin.h:33:5: error: use of undeclared identifier '__builtin_ia32_emms'; did you mean '__builtin_isless'?

	LIB_DEPENDS= libsndfile.so:audio/libsndfile
	diff --git a/games/ufoai-data/Makefile b/games/ufoai-data/Makefile
	--- a/games/ufoai-data/Makefile
	+++ b/games/ufoai-data/Makefile
	@@ -16,8 +16,6 @@
	LICENSE= GPLv2 CC-BY-SA-3.0
	LICENSE_COMB= multi

	-BROKEN_mips64= Fails to install: runaway process
	-
	EXTRACT_DEPENDS= ${UNZIP_CMD}:archivers/unzip

	NO_BUILD= yes
	diff --git a/games/urbanterror-data/Makefile b/games/urbanterror-data/Makefile
	--- a/games/urbanterror-data/Makefile
	+++ b/games/urbanterror-data/Makefile
	@@ -19,9 +19,6 @@
	LICENSE_TEXT= The mod files may not be sold or distributed on physical media unless with permission from id Software.
	LICENSE_PERMS= dist-mirror pkg-mirror auto-accept

	-BROKEN_mips= Fails to install: runaway process
	-BROKEN_mips64= Fails to install: runaway process
	-
	NO_BUILD= yes

	DATADIR= ${PREFIX}/share/quake3
	diff --git a/games/xoids/Makefile b/games/xoids/Makefile
	--- a/games/xoids/Makefile
	+++ b/games/xoids/Makefile
	@@ -7,9 +7,6 @@
	MAINTAINER= ports@FreeBSD.org
	COMMENT= X Window Asteroids style game with full color pixmaps

	-NOT_FOR_ARCHS= mips64
	-NOT_FOR_ARCHS_REASON= unknown architecture
	-
	USES= imake xorg
	USE_XORG= x11 xpm
	CFLAGS+= -fcommon
	diff --git a/graphics/Makefile b/graphics/Makefile
	--- a/graphics/Makefile
	+++ b/graphics/Makefile
	@@ -154,7 +154,6 @@
	SUBDIR += drawing
	SUBDIR += drawio
	SUBDIR += drawpile
	- SUBDIR += drm-510-kmod
	SUBDIR += drm-515-kmod
	SUBDIR += drm-61-kmod
	SUBDIR += drm-66-kmod
	@@ -632,9 +631,6 @@
	SUBDIR += npretty
	SUBDIR += nsxiv
	SUBDIR += nurbs++
	- SUBDIR += nvidia-drm-510-kmod
	- SUBDIR += nvidia-drm-510-kmod-580
	- SUBDIR += nvidia-drm-510-kmod-devel
	SUBDIR += nvidia-drm-515-kmod
	SUBDIR += nvidia-drm-515-kmod-580
	SUBDIR += nvidia-drm-515-kmod-devel
	diff --git a/graphics/R-cran-s2/Makefile b/graphics/R-cran-s2/Makefile
	--- a/graphics/R-cran-s2/Makefile
	+++ b/graphics/R-cran-s2/Makefile
	@@ -9,7 +9,7 @@

	LICENSE= APACHE20

	-NOT_FOR_ARCHS= armv6 mips
	+NOT_FOR_ARCHS= armv6
	NOT_FOR_ARCHS_REASON= is currently 64-bit only

	CRAN_DEPENDS= R-cran-Rcpp>0:devel/R-cran-Rcpp \
	diff --git a/graphics/drm-510-kmod/Makefile b/graphics/drm-510-kmod/Makefile
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/Makefile
	+++ /dev/null
	@@ -1,62 +0,0 @@
	-PORTNAME= drm-510-kmod
	-PORTVERSION= ${DRM_KMOD_DISTVERSION}
	-PORTREVISION= 13
	-CATEGORIES= graphics kld
	-
	-.include "Makefile.version"
	-
	-MAINTAINER= x11@FreeBSD.org
	-COMMENT= Direct Rendering Manager GPU drivers
	-WWW= https://github.com/freebsd/drm-kmod/
	-
	-LICENSE= BSD2CLAUSE MIT GPLv2
	-LICENSE_COMB= multi
	-
	-ONLY_FOR_ARCHS= aarch64 amd64 i386 powerpc64 powerpc64le
	-ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64, i386, aarch64, and powerpc64
	-
	-CONFLICTS_INSTALL= drm-515-kmod \
	- drm-61-kmod \
	- drm-66-kmod
	-
	-USES= kmod uidfix compiler:c++11-lang
	-
	-USE_GITHUB= yes
	-GH_ACCOUNT= freebsd
	-GH_PROJECT= drm-kmod
	-GH_TAGNAME= ${DRM_KMOD_GH_TAGNAME}
	-
	-.include <bsd.port.options.mk>
	-
	-SUB_FILES= pkg-message
	-SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1401501
	-IGNORE= not supported on FreeBSD 14.2 and higher
	-.endif
	-
	-.if ${OPSYS} != FreeBSD
	-IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
	-.endif
	-
	-.if ${ARCH} == "amd64"
	-PLIST_SUB+= AMDGPU=""
	-PLIST_SUB+= I915=""
	-.elif ${ARCH} == "i386"
	-PLIST_SUB+= AMDGPU="@comment "
	-PLIST_SUB+= I915=""
	-.elif ${ARCH} == "aarch64" \|\| ${ARCH:Mpowerpc*}
	-PLIST_SUB+= AMDGPU=""
	-PLIST_SUB+= I915="@comment "
	-.else
	-PLIST_SUB+= AMDGPU="@comment "
	-PLIST_SUB+= I915="@comment "
	-.endif
	-
	-MAKE_ENV+= MAKEOBJDIRPREFIX=${WRKSRC}/obj
	-
	-pre-build:
	- ${MKDIR} ${WRKSRC}/obj
	- (cd ${WRKSRC} ; ${SETENV} ${MAKE_ENV} ${MAKE_CMD} obj)
	-
	-.include <bsd.port.mk>
	diff --git a/graphics/drm-510-kmod/Makefile.version b/graphics/drm-510-kmod/Makefile.version
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/Makefile.version
	+++ /dev/null
	@@ -1,5 +0,0 @@
	-# drm-kmod common version definition
	-#
	-# This will be included from consumers such as nvidia-drm
	-DRM_KMOD_DISTVERSION= 5.10.163
	-DRM_KMOD_GH_TAGNAME= drm_v5.10.163_9
	diff --git a/graphics/drm-510-kmod/distinfo b/graphics/drm-510-kmod/distinfo
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/distinfo
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-TIMESTAMP = 1760982866
	-SHA256 (freebsd-drm-kmod-5.10.163-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
	-SIZE (freebsd-drm-kmod-5.10.163-drm_v5.10.163_9_GH0.tar.gz) = 20095205
	diff --git a/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c b/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c
	+++ /dev/null
	@@ -1,18 +0,0 @@
	---- drivers/gpu/drm/drm_os_freebsd.c.bak 2022-11-05 15:37:52.826643000 -0400
	-+++ drivers/gpu/drm/drm_os_freebsd.c 2022-11-05 15:38:25.740620000 -0400
	-@@ -202,11 +202,15 @@
	- #if __FreeBSD_version >= 1301505
	- #if __FreeBSD_version >= 1400058
	- DRIVER_MODULE(iicbus, drmn, iicbus_driver, NULL, NULL);
	-+#if defined(__amd64__) \|\| defined(__aarch64__) \|\| defined(__i386__)
	- DRIVER_MODULE(acpi_iicbus, drmn, acpi_iicbus_driver, NULL, NULL);
	-+#endif
	- #else
	- DRIVER_MODULE(iicbus, drmn, iicbus_driver, iicbus_devclass, NULL, NULL);
	-+#if defined(__amd64__) \|\| defined(__aarch64__) \|\| defined(__i386__)
	- DRIVER_MODULE(acpi_iicbus, drmn, acpi_iicbus_driver, iicbus_devclass, NULL,
	- NULL);
	-+#endif
	- #endif
	- MODULE_DEPEND(drmn, iicbus, IICBUS_MINVER, IICBUS_PREFVER, IICBUS_MAXVER);
	- MODULE_DEPEND(drmn, iic, 1, 1, 1);
	diff --git a/graphics/drm-510-kmod/files/pkg-message.in b/graphics/drm-510-kmod/files/pkg-message.in
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/files/pkg-message.in
	+++ /dev/null
	@@ -1,22 +0,0 @@
	-[
	-{ type: install
	- message: <<EOM
	-The drm-510-kmod port can be enabled for amdgpu (for AMD
	-GPUs starting with the HD7000 series / Tahiti) or i915kms (for Intel
	-APUs starting with HD3000 / Sandy Bridge) through kld_list in
	-/etc/rc.conf. radeonkms for older AMD GPUs can be loaded and there are
	-some positive reports if EFI boot is NOT enabled (similar to amdgpu).
	-
	-For amdgpu: kld_list="amdgpu"
	-For Intel: kld_list="i915kms"
	-For radeonkms: kld_list="radeonkms"
	-
	-Please ensure that all users requiring graphics are members of the
	-"video" group.
	-
	-Please note that this package was built for %%OPSYS%% %%OSREL%%.
	-If this is not your current running version, please rebuild
	-it from ports to prevent panics when loading the module.
	-EOM
	-}
	-]
	diff --git a/graphics/drm-510-kmod/pkg-descr b/graphics/drm-510-kmod/pkg-descr
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/pkg-descr
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-amdgpu, i915, and radeon DRM drivers modules.
	-Currently corresponding to Linux 5.10 DRM.
	-This version is for FreeBSD 13.1 and above.
	diff --git a/graphics/drm-510-kmod/pkg-plist b/graphics/drm-510-kmod/pkg-plist
	deleted file mode 100644
	--- a/graphics/drm-510-kmod/pkg-plist
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-/%%KMODDIR%%/dmabuf.ko
	-%%AMDGPU%%/%%KMODDIR%%/amdgpu.ko
	-/%%KMODDIR%%/drm.ko
	-%%I915%%/%%KMODDIR%%/i915kms.ko
	-/%%KMODDIR%%/linuxkpi_gplv2.ko
	-/%%KMODDIR%%/radeonkms.ko
	-/%%KMODDIR%%/ttm.ko
	diff --git a/graphics/drm-515-kmod/Makefile b/graphics/drm-515-kmod/Makefile
	--- a/graphics/drm-515-kmod/Makefile
	+++ b/graphics/drm-515-kmod/Makefile
	@@ -15,8 +15,7 @@
	ONLY_FOR_ARCHS= amd64 powerpc64 powerpc64le
	ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64 and powerpc64

	-CONFLICTS_INSTALL= drm-510-kmod \
	- drm-61-kmod \
	+CONFLICTS_INSTALL= drm-61-kmod \
	drm-66-kmod

	USES= kmod uidfix compiler:c++11-lang
	@@ -31,9 +30,7 @@
	SUB_FILES= pkg-message
	SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400081
	-IGNORE= not supported on older than 14.0, no kernel support
	-.elif ${OPSYS} == FreeBSD && ${OSVERSION} >= 1600000
	+.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1600000
	IGNORE= not supported on FreeBSD 16.0 and higher
	.endif
	.if ${OPSYS} != FreeBSD
	diff --git a/graphics/drm-61-kmod/Makefile b/graphics/drm-61-kmod/Makefile
	--- a/graphics/drm-61-kmod/Makefile
	+++ b/graphics/drm-61-kmod/Makefile
	@@ -15,8 +15,7 @@
	ONLY_FOR_ARCHS= amd64 powerpc64 powerpc64le
	ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64 and powerpc64

	-CONFLICTS_INSTALL= drm-510-kmod \
	- drm-515-kmod \
	+CONFLICTS_INSTALL= drm-515-kmod \
	drm-66-kmod

	USES= kmod uidfix compiler:c++11-lang
	@@ -31,9 +30,6 @@
	SUB_FILES= pkg-message
	SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}

	-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500008 \|\| ( ${OSVERSION} >= 1400508 && ${OSVERSION} < 1500000 ))
	-IGNORE= not supported on older than 14-STABLE 1400508, no kernel support
	-.endif
	.if ${OPSYS} != FreeBSD
	IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
	.endif
	diff --git a/graphics/drm-66-kmod/Makefile b/graphics/drm-66-kmod/Makefile
	--- a/graphics/drm-66-kmod/Makefile
	+++ b/graphics/drm-66-kmod/Makefile
	@@ -15,8 +15,7 @@
	ONLY_FOR_ARCHS= amd64
	ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64

	-CONFLICTS_INSTALL= drm-510-kmod \
	- drm-515-kmod \
	+CONFLICTS_INSTALL= drm-515-kmod \
	drm-61-kmod

	USES= kmod uidfix compiler:c++11-lang
	@@ -31,7 +30,7 @@
	SUB_FILES= pkg-message
	SUB_LIST= PORTNAME=${PORTNAME} OPSYS=${OPSYS} OSREL=${OSREL}

	-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500031 )
	+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500031
	IGNORE= not supported on older than 1500031, no kernel support
	.endif
	.if ${OPSYS} != FreeBSD
	diff --git a/graphics/drm-kmod/Makefile b/graphics/drm-kmod/Makefile
	--- a/graphics/drm-kmod/Makefile
	+++ b/graphics/drm-kmod/Makefile
	@@ -15,20 +15,12 @@
	.if ${OPSYS} != FreeBSD
	IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
	.else
	-. if ${OSVERSION} >= 1302000 && ${OSVERSION} < 1400097
	-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
	-_DRM_ARCHS= aarch64 amd64 i386 powerpc64 powerpc64le
	-. elif ${OSVERSION} >= 1400097 && (${ARCH} == i386 \|\| ${ARCH} == aarch64)
	-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
	-_DRM_ARCHS= aarch64 i386
	-. elif ${OSVERSION} >= 1500031 && ${ARCH} == amd64
	+. if ${OSVERSION} >= 1500031 && ${ARCH} == amd64
	RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-66-kmod
	_DRM_ARCHS= amd64
	-. elif ${OSVERSION} >= 1400508
	+. else
	RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-61-kmod
	_DRM_ARCHS= amd64 powerpc64 powerpc64le
	-. else
	-_DRM_ARCHS=
	. endif
	. if ! ${_DRM_ARCHS:M${ARCH}}
	IGNORE= not supported for this configuration
	diff --git a/graphics/drm-latest-kmod/Makefile b/graphics/drm-latest-kmod/Makefile
	--- a/graphics/drm-latest-kmod/Makefile
	+++ b/graphics/drm-latest-kmod/Makefile
	@@ -15,8 +15,7 @@
	ONLY_FOR_ARCHS= amd64
	ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64

	-CONFLICTS_INSTALL= drm-510-kmod \
	- drm-515-kmod \
	+CONFLICTS_INSTALL= drm-515-kmod \
	drm-61-kmod

	USES= kmod uidfix compiler:c++11-lang
	@@ -31,7 +30,7 @@
	SUB_FILES= pkg-message
	SUB_LIST= PORTNAME=${PORTNAME} OPSYS=${OPSYS} OSREL=${OSREL}

	-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500058 )
	+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500058
	IGNORE= not supported on older than 1500058, no kernel support
	.endif
	.if ${OPSYS} != FreeBSD
	diff --git a/graphics/dspdfviewer/Makefile b/graphics/dspdfviewer/Makefile
	--- a/graphics/dspdfviewer/Makefile
	+++ b/graphics/dspdfviewer/Makefile
	@@ -49,9 +49,7 @@
	CFLAGS+= -Wno-error=suggest-destructor-override
	CFLAGS+= -Wno-error=suggest-override
	# Fixes build failure for Clang 14.0.3
	-.if ${OSVERSION} >= 1400059
	CFLAGS+= -Wno-error=bitwise-instead-of-logical
	-.endif
	# Fixes build failure for Clang 16.0.6
	CFLAGS+= -Wno-error=unsafe-buffer-usage
	# Fixes build failure for Clang 18.1.4
	diff --git a/graphics/exiv2/Makefile b/graphics/exiv2/Makefile
	--- a/graphics/exiv2/Makefile
	+++ b/graphics/exiv2/Makefile
	@@ -30,9 +30,6 @@
	CMAKE_ON= EXIV2_ENABLE_VIDEO
	CMAKE_OFF= EXIV2_ENABLE_EXTERNAL_XMP

	-LDFLAGS_mips= -lintl
	-LDFLAGS_mips64= -lintl
	-
	PLIST_SUB= SOVER=${DISTVERSION:R:E} \
	SOVERSION=${DISTVERSION}

	diff --git a/graphics/freeimage/Makefile b/graphics/freeimage/Makefile
	--- a/graphics/freeimage/Makefile
	+++ b/graphics/freeimage/Makefile
	@@ -17,9 +17,6 @@
	LICENSE_FILE_GPLv3= ${WRKSRC}/license-gplv3.txt
	LICENSE_PERMS_FIPL= dist-mirror pkg-mirror auto-accept

	-BROKEN_mips= fails to compile: section referenced in discarded section
	-BROKEN_mips64= fails to compile: opcode not supported on this processor: mips3 (mips3) 'madd $4,$5'
	-
	USES= cpe dos2unix gmake zip
	USE_CXXSTD= gnu++14
	CPE_VENDOR= ${PORTNAME}_project
	diff --git a/graphics/gdchart/Makefile b/graphics/gdchart/Makefile
	--- a/graphics/gdchart/Makefile
	+++ b/graphics/gdchart/Makefile
	@@ -26,7 +26,7 @@

	.include <bsd.port.options.mk>

	-.if defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
	+.if defined(NO_PROFILE) \|\| ${OPSYS} == FreeBSD
	PLIST_SUB+= PROFILE="@comment "
	.else
	PLIST_SUB+= PROFILE=""
	diff --git a/graphics/gifsicle/Makefile b/graphics/gifsicle/Makefile
	--- a/graphics/gifsicle/Makefile
	+++ b/graphics/gifsicle/Makefile
	@@ -10,9 +10,6 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= fails to build: undefined reference to '__sync_add_and_fetch_4'
	-BROKEN_mips64= fails to build: undefined reference to '__sync_add_and_fetch_4'
	-
	FLAVORS= x11 nox11
	FLAVOR?= ${FLAVORS:[1]}
	nox11_PKGNAMESUFFIX= -nox11
	diff --git a/graphics/mozjpeg/Makefile b/graphics/mozjpeg/Makefile
	--- a/graphics/mozjpeg/Makefile
	+++ b/graphics/mozjpeg/Makefile
	@@ -10,8 +10,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE.md

	-BROKEN_mips64= does not configure: error: SIMD support cannot be enabled
	-
	BUILD_DEPENDS= nasm>=2.10,1:devel/nasm
	LIB_DEPENDS= libpng.so:graphics/png

	diff --git a/graphics/nvidia-drm-510-kmod-580/Makefile b/graphics/nvidia-drm-510-kmod-580/Makefile
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod-580/Makefile
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-NVIDIA_DISTVERSION?= 580.142
	-# Explicitly set PORTREVISION as it can be overridden by the master port
	-PORTREVISION= 0
	-MASTERDIR= ${.CURDIR}/../nvidia-drm-510-kmod
	-PKGNAMESUFFIX= -580
	-
	-.include "${MASTERDIR}/Makefile"
	diff --git a/graphics/nvidia-drm-510-kmod-580/distinfo b/graphics/nvidia-drm-510-kmod-580/distinfo
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod-580/distinfo
	+++ /dev/null
	@@ -1,5 +0,0 @@
	-TIMESTAMP = 1773188138
	-SHA256 (NVIDIA-FreeBSD-x86_64-580.142.tar.xz) = 94797e09407062032f5793a68360a35133b4062bcc15490d9f215d9183ac849c
	-SIZE (NVIDIA-FreeBSD-x86_64-580.142.tar.xz) = 289723464
	-SHA256 (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
	-SIZE (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = 20095205
	diff --git a/graphics/nvidia-drm-510-kmod-devel/Makefile b/graphics/nvidia-drm-510-kmod-devel/Makefile
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod-devel/Makefile
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-NVIDIA_DISTVERSION?= 595.58.03
	-# Explicitly set PORTREVISION as it can be overridden by the master port
	-PORTREVISION= 0
	-MASTERDIR= ${.CURDIR}/../nvidia-drm-510-kmod
	-PKGNAMESUFFIX= -devel
	-
	-.include "${MASTERDIR}/Makefile"
	diff --git a/graphics/nvidia-drm-510-kmod-devel/distinfo b/graphics/nvidia-drm-510-kmod-devel/distinfo
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod-devel/distinfo
	+++ /dev/null
	@@ -1,5 +0,0 @@
	-TIMESTAMP = 1774374059
	-SHA256 (NVIDIA-FreeBSD-x86_64-595.58.03.tar.xz) = dccbda46fc39dbfe081f1333c7227b480c86e6d5125bb5a03ab782995bdda6ef
	-SIZE (NVIDIA-FreeBSD-x86_64-595.58.03.tar.xz) = 328835816
	-SHA256 (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
	-SIZE (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = 20095205
	diff --git a/graphics/nvidia-drm-510-kmod/Makefile b/graphics/nvidia-drm-510-kmod/Makefile
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/Makefile
	+++ /dev/null
	@@ -1,12 +0,0 @@
	-PORTNAME= nvidia-drm-510-kmod
	-PORTREVISION= 0
	-CATEGORIES= graphics
	-
	-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
	-CONFLICTS_INSTALL= nvidia-drm-515-kmod* nvidia-drm-61-kmod* nvidia-drm-66-kmod*
	-
	-.include "${.CURDIR}/../drm-510-kmod/Makefile.version"
	-.include "${.CURDIR}/../nvidia-drm-kmod/Makefile.common"
	-.include <bsd.port.options.mk>
	-
	-.include <bsd.port.mk>
	diff --git a/graphics/nvidia-drm-510-kmod/distinfo b/graphics/nvidia-drm-510-kmod/distinfo
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/distinfo
	+++ /dev/null
	@@ -1,5 +0,0 @@
	-TIMESTAMP = 1774374059
	-SHA256 (NVIDIA-FreeBSD-x86_64-595.58.03.tar.xz) = dccbda46fc39dbfe081f1333c7227b480c86e6d5125bb5a03ab782995bdda6ef
	-SIZE (NVIDIA-FreeBSD-x86_64-595.58.03.tar.xz) = 328835816
	-SHA256 (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
	-SIZE (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = 20095205
	diff --git a/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in b/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in
	+++ /dev/null
	@@ -1,8 +0,0 @@
	-Section "OutputClass"
	- Identifier "nvidia"
	- MatchDriver "nvidia-drm"
	- Driver "nvidia"
	- Option "PrimaryGPU" "yes"
	- ModulePath "%%LOCALBASE%%/lib/nvidia/xorg"
	- ModulePath "%%LOCALBASE%%/lib/xorg/modules"
	-EndSection
	diff --git a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h b/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h
	+++ /dev/null
	@@ -1,14 +0,0 @@
	---- nvidia-drm-conftest.h.orig 2024-02-22 01:03:15 UTC
	-+++ nvidia-drm-conftest.h
	-@@ -85,7 +85,11 @@
	-
	- /* For nv_drm_gem_prime_force_fence_signal */
	- #ifndef spin_is_locked
	-+#if ((__FreeBSD_version >= 1500000) && (__FreeBSD_version < 1500018)) \|\| (__FreeBSD_version < 1401501)
	- #define spin_is_locked(lock) mtx_owned(lock.m)
	-+#else
	-+#define spin_is_locked(lock) mtx_owned(lock)
	-+#endif
	- #endif
	-
	- #ifndef rwsem_is_locked
	diff --git a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c b/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c
	+++ /dev/null
	@@ -1,46 +0,0 @@
	---- nvidia-drm-freebsd-lkpi.c.orig 2024-02-22 01:03:15 UTC
	-+++ nvidia-drm-freebsd-lkpi.c
	-@@ -115,6 +115,7 @@ int nv_drm_probe_devices(void)
	- * by the native nvidia.ko by using our devclass.
	- */
	- for (int i = 0; i < NV_MAX_DEVICES; i++) {
	-+ struct pci_dev *pdev;
	- nv_gpu_info_t gpu_info;
	- struct nvidia_softc *sc = devclass_get_softc(nvidia_devclass, i);
	- if (!sc) {
	-@@ -124,11 +125,33 @@ int nv_drm_probe_devices(void)
	- nv_state_t *nv = sc->nv_state;
	-
	- /*
	-+ * Set the ivars for this device if they are not already populated. This
	-+ * is the bus specific data, and linuxkpi will try to use it.
	-+ */
	-+ if (!device_get_ivars(sc->dev)) {
	-+ device_t parent = device_get_parent(sc->dev);
	-+ struct pci_devinfo *dinfo = device_get_ivars(parent);
	-+ device_set_ivars(sc->dev, dinfo);
	-+ }
	-+
	-+ /*
	- * Now we have the state (which gives us the device_t), but what nvidia-drm
	- * wants is a pci_dev suitable for use with linuxkpi code. We can use
	-- * lkpinew_pci_dev to fill in a pci_dev struct,
	-+ * lkpinew_pci_dev to fill in a pci_dev struct, or linux_pci_attach on more
	-+ * recent kernels (introduced by 253dbe7487705).
	- */
	-- struct pci_dev *pdev = lkpinew_pci_dev(sc->dev);
	-+#if __FreeBSD_version < 1300093
	-+ pdev = lkpinew_pci_dev(sc->dev);
	-+#else
	-+ pdev = malloc(sizeof(*pdev), M_DEVBUF, M_WAITOK\|M_ZERO);
	-+ if (!pdev) {
	-+ return -ENOMEM;
	-+ }
	-+
	-+ if (linux_pci_attach_device(sc->dev, NULL, NULL, pdev)) {
	-+ return -ENOMEM;
	-+ }
	-+#endif
	- nv_lkpi_pci_devs[i] = pdev;
	-
	- gpu_info.gpu_id = nv->gpu_id;
	diff --git a/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h b/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h
	+++ /dev/null
	@@ -1,14 +0,0 @@
	---- nvidia-drm-conftest.h.orig 2024-03-11 17:52:16 UTC
	-+++ nvidia-drm-conftest.h
	-@@ -122,11 +122,9 @@
	- */
	- #define drm_atomic_state_free drm_atomic_state_put
	-
	--#if __FreeBSD_version < 1300000
	- /* redefine LIST_HEAD_INIT to the linux version */
	- #include <linux/list.h>
	- #define LIST_HEAD_INIT(name) LINUX_LIST_HEAD_INIT(name)
	--#endif
	-
	- /*
	- * FreeBSD currently has only vmf_insert_pfn_prot defined, and it has a
	diff --git a/graphics/nvidia-drm-510-kmod/pkg-descr b/graphics/nvidia-drm-510-kmod/pkg-descr
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/pkg-descr
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-FreeBSD port of Linux's nvidia-drm.ko Kernel module.
	-
	-This version is compatible with drm.ko 5.10.
	diff --git a/graphics/nvidia-drm-510-kmod/pkg-message b/graphics/nvidia-drm-510-kmod/pkg-message
	deleted file mode 100644
	--- a/graphics/nvidia-drm-510-kmod/pkg-message
	+++ /dev/null
	@@ -1,8 +0,0 @@
	-Modesetting must be enabled to use nvidia-drm.ko for graphics. This can be done
	-by setting the modeset sysctl, the equivalent of the modeset kernel parameter
	-on Linux.
	-
	-hw.nvidiadrm.modeset=1
	-
	-This must be set before loading nvidia-drm.ko, most easily done by placing the
	-above in /boot/loader.conf.
	diff --git a/graphics/nvidia-drm-kmod/Makefile b/graphics/nvidia-drm-kmod/Makefile
	--- a/graphics/nvidia-drm-kmod/Makefile
	+++ b/graphics/nvidia-drm-kmod/Makefile
	@@ -15,13 +15,9 @@
	.if ${OPSYS} != FreeBSD
	IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
	.else
	-. if ${OSVERSION} >= 1302000 && ${OSVERSION} < 1400097
	-RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-510-kmod${PKGNAMESUFFIX}
	-. elif ${OSVERSION} >= 1400097 && (${ARCH} == i386 \|\| ${ARCH} == aarch64)
	-RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-510-kmod${PKGNAMESUFFIX}
	-. elif ${OSVERSION} >= 1500031 && ${ARCH} == amd64
	+. if ${OSVERSION} >= 1500031 && ${ARCH} == amd64
	RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-66-kmod${PKGNAMESUFFIX}
	-. elif ${OSVERSION} >= 1400508
	+. else
	RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-61-kmod${PKGNAMESUFFIX}
	. endif
	.endif
	diff --git a/graphics/ttyplot/Makefile b/graphics/ttyplot/Makefile
	--- a/graphics/ttyplot/Makefile
	+++ b/graphics/ttyplot/Makefile
	@@ -9,8 +9,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= fails to build: Package 'ncursesw' not found
	-
	USES= ncurses pkgconfig
	USE_GITHUB= yes
	GH_ACCOUNT= tenox7
	diff --git a/graphics/wings/Makefile b/graphics/wings/Makefile
	--- a/graphics/wings/Makefile
	+++ b/graphics/wings/Makefile
	@@ -14,7 +14,7 @@
	LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept

	# c_src/Makefile line 103
	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
	NOT_FOR_ARCHS_REASON= subcomponent libigl does not support 32bit platforms

	BUILD_DEPENDS= erl:lang/erlang \
	diff --git a/irc/undernet-ircu/Makefile b/irc/undernet-ircu/Makefile
	--- a/irc/undernet-ircu/Makefile
	+++ b/irc/undernet-ircu/Makefile
	@@ -63,8 +63,8 @@

	.include <bsd.port.options.mk>

	-.if !defined(NO_PROFILE) && ( ${OPSYS} == FreeBSD && ${OSVERSION} < 1400079 )
	-CONFIGURE_ARGS+= --enable-profile
	+.if !defined(NO_PROFILE)
	+CONFIGURE_ARGS+= --enable-profile
	.endif

	do-install:
	diff --git a/japanese/man/Makefile b/japanese/man/Makefile
	--- a/japanese/man/Makefile
	+++ b/japanese/man/Makefile
	@@ -18,8 +18,6 @@
	RUN_DEPENDS= ${LOCALBASE}/bin/groff:japanese/groff \
	jless:japanese/less

	-BROKEN_mips= fails to compile: man.c:37:10: fatal error: 'config.h' file not found
	-
	MAKE_ENV= GZCAT=${GZCAT} GZIP_CMD="${GZIP_CMD}"
	USES= shebangfix
	SHEBANG_FILES= catman/catman.perl makewhatis/makewhatis.perl
	diff --git a/japanese/mecab/Makefile b/japanese/mecab/Makefile
	--- a/japanese/mecab/Makefile
	+++ b/japanese/mecab/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= BSD3CLAUSE GPLv2 LGPL21
	LICENSE_COMB= multi

	-BROKEN_mips= fails to link: Nonrepresentable section on output
	-BROKEN_mips64= fails to link: Nonrepresentable section on output
	-
	USES= gettext-tools iconv libtool localbase perl5
	USE_CXXSTD= c++14
	USE_LDCONFIG= yes
	diff --git a/japanese/mozc-server/Makefile b/japanese/mozc-server/Makefile
	--- a/japanese/mozc-server/Makefile
	+++ b/japanese/mozc-server/Makefile
	@@ -14,7 +14,6 @@
	libzinnia.so:japanese/zinnia
	RUN_DEPENDS= xdg-open:devel/xdg-utils

	-BROKEN_FreeBSD_13_powerpc64= fails to build: ERROR: ninja -v -C out_linux/Release mozc_server: Error code 1
	BROKEN_powerpc= fails to compile: segfault

	USE_GITHUB= yes
	diff --git a/java/openjdk11/Makefile b/java/openjdk11/Makefile
	--- a/java/openjdk11/Makefile
	+++ b/java/openjdk11/Makefile
	@@ -133,11 +133,6 @@

	.include <bsd.port.pre.mk>

	-# portsfallout.com shows flapping builds on 13.5 and 14.2
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403000
	-MAKE_JOBS_UNSAFE= yes
	-.endif
	-
	.if !${PORT_OPTIONS:MCUPS}
	MASTER_SITES+= https://codeload.github.com/OpenPrinting/cups/tar.gz/v${CUPS_INC_VER}?dummy=/:cups
	.endif
	diff --git a/java/openjdk17/Makefile b/java/openjdk17/Makefile
	--- a/java/openjdk17/Makefile
	+++ b/java/openjdk17/Makefile
	@@ -121,7 +121,7 @@

	.include <bsd.port.pre.mk>

	-# portsfallout.com shows flapping builds on 13.5 and 14.2
	+# portsfallout.com shows flapping builds on 14.2
	.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000
	MAKE_JOBS_NUMBER_LIMIT= 3
	.endif
	diff --git a/java/openjdk23/Makefile b/java/openjdk23/Makefile
	--- a/java/openjdk23/Makefile
	+++ b/java/openjdk23/Makefile
	@@ -21,7 +21,6 @@
	# On FreeBSD 14 and 15 the i386 build fails with a segfault in java during the
	# buildtools_create_symbols_javac__the.COMPILE_CREATE_SYMBOLS_batch build step.
	#
	-BROKEN_FreeBSD_13_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'
	BROKEN_FreeBSD_14_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'
	BROKEN_FreeBSD_15_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'

	diff --git a/lang/dotnet/Makefile b/lang/dotnet/Makefile
	--- a/lang/dotnet/Makefile
	+++ b/lang/dotnet/Makefile
	@@ -22,7 +22,8 @@
	cmake:devel/cmake-core \
	git:devel/git \
	ggrep:textproc/gnugrep \
	- terminfo-db>0:misc/terminfo-db
	+ terminfo-db>0:misc/terminfo-db \
	+ ${LOCALBASE}/lib/compat/libssl.so.111:misc/compat13x
	LIB_DEPENDS= libbrotlienc.so:archivers/brotli \
	libicuuc.so:devel/icu \
	libinotify.so:devel/libinotify \
	@@ -89,10 +90,6 @@
	EXTRA_PATCHES= ${PATCHDIR}/extra-patch-base-openssl
	.endif

	-.if ${OSVERSION} >= 1400000
	-BUILD_DEPENDS+= ${LOCALBASE}/lib/compat/libssl.so.111:misc/compat13x
	-.endif
	-
	.if ${ARCH} == amd64
	PLIST_SUB+= VXSORT=
	.else
	diff --git a/lang/ecl/Makefile b/lang/ecl/Makefile
	--- a/lang/ecl/Makefile
	+++ b/lang/ecl/Makefile
	@@ -9,9 +9,6 @@

	LICENSE= LGPL20

	-BROKEN_mips= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
	-BROKEN_mips64= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
	-
	BUILD_DEPENDS= ${LOCALBASE}/lib/libatomic_ops.a:devel/libatomic_ops
	LIB_DEPENDS= libgc.so:devel/boehm-gc \
	libgmp.so:math/gmp
	diff --git a/lang/erlang-runtime22/Makefile b/lang/erlang-runtime22/Makefile
	--- a/lang/erlang-runtime22/Makefile
	+++ b/lang/erlang-runtime22/Makefile
	@@ -106,7 +106,7 @@
	MAKE_ARGS+= ARCH=arm
	.endif

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CFLAGS+= -Wno-error=implicit-function-declaration
	OPTIONS_EXCLUDE= OPENSSL
	.endif
	diff --git a/lang/erlang-runtime23/Makefile b/lang/erlang-runtime23/Makefile
	--- a/lang/erlang-runtime23/Makefile
	+++ b/lang/erlang-runtime23/Makefile
	@@ -105,7 +105,7 @@
	MAKE_ARGS+= ARCH=arm
	.endif

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CFLAGS+= -Wno-error=implicit-function-declaration
	OPTIONS_EXCLUDE= OPENSSL
	.endif
	diff --git a/lang/f2c/Makefile b/lang/f2c/Makefile
	--- a/lang/f2c/Makefile
	+++ b/lang/f2c/Makefile
	@@ -15,9 +15,6 @@
	LICENSE_FILE= ${WRKSRC}/libf2c/Notice
	LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept

	-BROKEN_mips= fails to compile: /usr/include/sigfpe.h: No such file or directory
	-BROKEN_mips64= fails to compile: /usr/include/sigfpe.h: No such file or directory
	-
	USES= gmake
	USE_LDCONFIG= yes

	diff --git a/lang/gauche/Makefile b/lang/gauche/Makefile
	--- a/lang/gauche/Makefile
	+++ b/lang/gauche/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= Fails to build: redefinition of GC_register_dynamic_libraries
	-BROKEN_mips64= Fails to build: redefinition of GC_register_dynamic_libraries
	BROKEN_riscv64= Fails to build: ./include/private/gcconfig.h:709:5: The collector has not been ported to this machine/OS combination

	USES= compiler:c11 cpe gmake iconv makeinfo tar:tgz
	diff --git a/lang/inko/Makefile b/lang/inko/Makefile
	--- a/lang/inko/Makefile
	+++ b/lang/inko/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= MPL20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # build fails on non-64-bit architectures: Inko requires a 64-bits architecture
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # build fails on non-64-bit architectures: Inko requires a 64-bits architecture

	LIB_DEPENDS= libffi.so:devel/libffi \
	libzstd.so:archivers/zstd
	diff --git a/lang/luajit-openresty/Makefile b/lang/luajit-openresty/Makefile
	--- a/lang/luajit-openresty/Makefile
	+++ b/lang/luajit-openresty/Makefile
	@@ -34,10 +34,6 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH:Mmips*}
	-USE_GCC=yes
	-.endif
	-
	post-install:
	${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/${PORTNAME}-${LUAJIT_SOVERSION}
	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libluajit-5.1.so.${LUAJIT_SOVERSION}
	diff --git a/lang/mono6.8/Makefile b/lang/mono6.8/Makefile
	--- a/lang/mono6.8/Makefile
	+++ b/lang/mono6.8/Makefile
	@@ -13,7 +13,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= riscv64 riscv64sf
	+NOT_FOR_ARCHS= riscv64

	BUILD_DEPENDS= p5-XML-Parser>=0:textproc/p5-XML-Parser \
	bash:shells/bash \
	diff --git a/lang/mosh/Makefile b/lang/mosh/Makefile
	--- a/lang/mosh/Makefile
	+++ b/lang/mosh/Makefile
	@@ -12,7 +12,6 @@

	BROKEN_armv6= fails to link: os_dep.c: undefined reference to '__stack_base__'
	BROKEN_armv7= fails to link: os_dep.c: undefined reference to '__stack_base__'
	-BROKEN_mips64= fails to compile: os_dep.c: redefinition of 'GC_register_dynamic_libraries'
	NOT_FOR_ARCHS= aarch64 riscv64
	NOT_FOR_ARCHS_REASON= gcconfig.h: the collector has not been ported to this machine/OS combination

	diff --git a/lang/mosml/Makefile b/lang/mosml/Makefile
	--- a/lang/mosml/Makefile
	+++ b/lang/mosml/Makefile
	@@ -14,8 +14,6 @@
	LICENSE_TEXT= Restrictions on for-profit distribution
	LICENSE_PERMS= auto-accept

	-BROKEN_mips= does not configure: this architecture seems to be neither big endian nor little endian
	-BROKEN_mips64= does not configure: this architecture seems to be neither big endian nor little endian
	BROKEN_powerpc64= does not configure: this architecture seems to be neither big endian nor little endian

	LIB_DEPENDS= libgmp.so:math/gmp \
	diff --git a/lang/opencoarrays/Makefile b/lang/opencoarrays/Makefile
	--- a/lang/opencoarrays/Makefile
	+++ b/lang/opencoarrays/Makefile
	@@ -35,13 +35,11 @@
	OPTIONS_EXCLUDE_armv6= MPICH
	OPTIONS_EXCLUDE_armv7= MPICH
	OPTIONS_EXCLUDE_i386= MPICH
	-OPTIONS_EXCLUDE_mips= MPICH
	OPTIONS_EXCLUDE_powerpc= MPICH
	OPTIONS_EXCLUDE_powerpcspe= MPICH
	OPTIONS_DEFAULT_armv6= OPENMPI
	OPTIONS_DEFAULT_armv7= OPENMPI
	OPTIONS_DEFAULT_i386= OPENMPI
	-OPTIONS_DEFAULT_mips= OPENMPI
	OPTIONS_DEFAULT_powerpc= OPENMPI
	OPTIONS_DEFAULT_powerpcspe= OPENMPI

	diff --git a/lang/opensycl/Makefile b/lang/opensycl/Makefile
	--- a/lang/opensycl/Makefile
	+++ b/lang/opensycl/Makefile
	@@ -11,7 +11,6 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE

	BROKEN_i386= fails to compile: error: static_assert failed due to requirement 'sizeof(hipsycl::glue::unique_id) == 2 * sizeof(void *)'
	-BROKEN_FreeBSD_13_armv7= configure fails: Cannot run simple program using std::filesystem

	BUILD_DEPENDS= boost-libs>0:devel/boost-libs

	diff --git a/lang/perl5-devel/Makefile b/lang/perl5-devel/Makefile
	--- a/lang/perl5-devel/Makefile
	+++ b/lang/perl5-devel/Makefile
	@@ -143,8 +143,7 @@
	OPTIONS_EXCLUDE= DTRACE
	.endif
	.for a in aarch64 armv6 armv7 \
	- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
	- riscv64 riscv64sf
	+ riscv64
	OPTIONS_EXCLUDE_${a}= DTRACE
	.endfor
	OPTIONS_SUB= yes
	diff --git a/lang/perl5.38/Makefile b/lang/perl5.38/Makefile
	--- a/lang/perl5.38/Makefile
	+++ b/lang/perl5.38/Makefile
	@@ -132,8 +132,7 @@
	OPTIONS_EXCLUDE= DTRACE
	.endif
	.for a in aarch64 armv6 armv7 \
	- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
	- riscv64 riscv64sf
	+ riscv64
	OPTIONS_EXCLUDE_${a}= DTRACE
	.endfor
	OPTIONS_SUB= yes
	diff --git a/lang/perl5.40/Makefile b/lang/perl5.40/Makefile
	--- a/lang/perl5.40/Makefile
	+++ b/lang/perl5.40/Makefile
	@@ -131,8 +131,7 @@
	OPTIONS_EXCLUDE= DTRACE
	.endif
	.for a in aarch64 armv6 armv7 \
	- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
	- riscv64 riscv64sf
	+ riscv64
	OPTIONS_EXCLUDE_${a}= DTRACE
	.endfor
	OPTIONS_SUB= yes
	diff --git a/lang/perl5.42/Makefile b/lang/perl5.42/Makefile
	--- a/lang/perl5.42/Makefile
	+++ b/lang/perl5.42/Makefile
	@@ -133,8 +133,7 @@
	OPTIONS_EXCLUDE= DTRACE
	.endif
	.for a in aarch64 armv6 armv7 \
	- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
	- riscv64 riscv64sf
	+ riscv64
	OPTIONS_EXCLUDE_${a}= DTRACE
	.endfor
	OPTIONS_SUB= yes
	diff --git a/lang/php82/Makefile b/lang/php82/Makefile
	--- a/lang/php82/Makefile
	+++ b/lang/php82/Makefile
	@@ -47,9 +47,6 @@
	# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
	OPTIONS_EXCLUDE_armv6= DTRACE
	OPTIONS_EXCLUDE_armv7= DTRACE
	-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
	-OPTIONS_EXCLUDE_mips= DTRACE FPM
	-OPTIONS_EXCLUDE_mips64= DTRACE FPM
	OPTIONS_EXCLUDE_riscv64= DTRACE
	NO_OPTIONS_SORT= yes
	OPTIONS_SUB= yes
	diff --git a/lang/php83/Makefile b/lang/php83/Makefile
	--- a/lang/php83/Makefile
	+++ b/lang/php83/Makefile
	@@ -47,9 +47,6 @@
	# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
	OPTIONS_EXCLUDE_armv6= DTRACE
	OPTIONS_EXCLUDE_armv7= DTRACE
	-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
	-OPTIONS_EXCLUDE_mips= DTRACE FPM
	-OPTIONS_EXCLUDE_mips64= DTRACE FPM
	OPTIONS_EXCLUDE_riscv64= DTRACE
	NO_OPTIONS_SORT= yes
	OPTIONS_SUB= yes
	diff --git a/lang/php84/Makefile b/lang/php84/Makefile
	--- a/lang/php84/Makefile
	+++ b/lang/php84/Makefile
	@@ -45,9 +45,6 @@
	# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
	OPTIONS_EXCLUDE_armv6= DTRACE
	OPTIONS_EXCLUDE_armv7= DTRACE
	-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
	-OPTIONS_EXCLUDE_mips= DTRACE FPM
	-OPTIONS_EXCLUDE_mips64= DTRACE FPM
	OPTIONS_EXCLUDE_riscv64= DTRACE
	NO_OPTIONS_SORT= yes
	OPTIONS_SUB= yes
	diff --git a/lang/php85/Makefile b/lang/php85/Makefile
	--- a/lang/php85/Makefile
	+++ b/lang/php85/Makefile
	@@ -46,9 +46,6 @@
	# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
	OPTIONS_EXCLUDE_armv6= DTRACE
	OPTIONS_EXCLUDE_armv7= DTRACE
	-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
	-OPTIONS_EXCLUDE_mips= DTRACE FPM
	-OPTIONS_EXCLUDE_mips64= DTRACE FPM
	OPTIONS_EXCLUDE_riscv64= DTRACE
	NO_OPTIONS_SORT= yes
	OPTIONS_SUB= yes
	diff --git a/lang/python27/Makefile b/lang/python27/Makefile
	--- a/lang/python27/Makefile
	+++ b/lang/python27/Makefile
	@@ -120,7 +120,7 @@
	# openssl/opensslv.h so setup.py just detects the string as 00000000
	# However care should be taken for the OSVERSION. If OpenSSL 3.0.9
	# lands later the OSVERSION string should be fixed accordingly
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && (${SSL_DEFAULT} == base \|\| \
	+.if ${OPSYS} == FreeBSD && (${SSL_DEFAULT} == base \|\| \
	${SSL_DEFAULT} == openssl \|\| ${SSL_DEFAULT:Mopenssl3*} )
	@${REINPLACE_CMD} -e 's\|00907000\|00000000\|' \
	${WRKSRC}/setup.py
	diff --git a/lang/swift510/Makefile b/lang/swift510/Makefile
	--- a/lang/swift510/Makefile
	+++ b/lang/swift510/Makefile
	@@ -80,12 +80,6 @@
	PLIST_SUB= SWIFT_ARCH=${swift_arch} \
	SWIFT_TARGET_TRIPLE=${swift_arch}-unknown-freebsd${OSREL}

	-.include <bsd.port.pre.mk>
	-
	-.if ${OSVERSION} >= 1304500 && ${OSVERSION} <= 1305502
	-BROKEN= Unbuildable due to a problem with libc++. See <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=286342>
	-.endif
	-
	pre-patch:
	@${MKDIR} ${WRKSRC}/llbuild/lib/LLBSQLite3

	@@ -111,4 +105,4 @@
	${COPYTREE_SHARE} .${swift_install_prefix}/$${subdir} ${STAGEDIR} ; \
	done

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/lang/swipl/Makefile b/lang/swipl/Makefile
	--- a/lang/swipl/Makefile
	+++ b/lang/swipl/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= BSD2CLAUSE

	BROKEN_i386= FAILED: man/lib/clpfdlib.tex
	-BROKEN_mips= fails to link: libswipl.so: undefined reference to '__sync_sub_and_fetch_4'
	-BROKEN_mips64= fails to link: libswipl.so: undefined reference to '__sync_sub_and_fetch_4'

	LIB_DEPENDS= libpcre2-posix.so:devel/pcre2 \
	libossp-uuid.so:misc/ossp-uuid \
	diff --git a/mail/archiveopteryx/Makefile b/mail/archiveopteryx/Makefile
	--- a/mail/archiveopteryx/Makefile
	+++ b/mail/archiveopteryx/Makefile
	@@ -50,7 +50,7 @@
	${WRKSRC}/Jamsettings
	${REINPLACE_CMD} -e "s\|$-lcrypto$\|-L${OPENSSLLIB} \1\|g" \
	${WRKSRC}/server/Jamfile
	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	@${REINPLACE_CMD} -e 's\|-Werror\|-Werror -DOPENSSL_API_COMPAT=0x10100000L\|g' \
	${WRKSRC}/Jamsettings
	.endif
	diff --git a/mail/fetchmail/Makefile b/mail/fetchmail/Makefile
	--- a/mail/fetchmail/Makefile
	+++ b/mail/fetchmail/Makefile
	@@ -108,10 +108,8 @@
	.include <bsd.port.pre.mk>

	.if ${PORT_OPTIONS:MOPIE} && ${MASTERDIR} == ${.CURDIR} && ${OPSYS} == FreeBSD
	-. if ${OSVERSION} >= 1400072
	LIB_DEPENDS+= libopie.so:security/opie # moved to port (from base in 13.X)
	CPPFLAGS+= -I${LOCALBASE}/include
	-. endif
	.endif

	.include <bsd.port.post.mk>
	diff --git a/mail/mlmmj/Makefile b/mail/mlmmj/Makefile
	--- a/mail/mlmmj/Makefile
	+++ b/mail/mlmmj/Makefile
	@@ -27,8 +27,7 @@
	p5-HTML-Parser>0:www/p5-HTML-Parser
	PHP_USES= php:web

	-TEST_DEPENDS= kyua:devel/kyua \
	- atf-sh:devel/atf
	+TEST_DEPENDS= atf-sh:devel/atf
	TEST_TARGET= check

	post-install-DOCS-on:
	diff --git a/mail/rmilter/Makefile b/mail/rmilter/Makefile
	--- a/mail/rmilter/Makefile
	+++ b/mail/rmilter/Makefile
	@@ -11,9 +11,6 @@

	LIB_DEPENDS= libpcre.so:devel/pcre

	-NOT_FOR_ARCHS= mips
	-NOT_FOR_ARCHS_REASON= fails to compile: error: Unsupported word size
	-
	USE_GITHUB= yes
	GH_ACCOUNT= vstakhov

	diff --git a/math/colpack/Makefile b/math/colpack/Makefile
	--- a/math/colpack/Makefile
	+++ b/math/colpack/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13_armv7= compilation fails: error: expected identifier before '__is_convertible'
	-
	USES= cmake
	USE_LDCONFIG= yes

	diff --git a/math/gecode/Makefile b/math/gecode/Makefile
	--- a/math/gecode/Makefile
	+++ b/math/gecode/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= BSL MIT
	LICENSE_COMB= multi

	-NOT_FOR_ARCHS= armv6 armv7 mips mips64
	+NOT_FOR_ARCHS= armv6 armv7
	NOT_FOR_ARCHS_REASON= needs code written to specify rounding control mechanism in Boost.Numeric.Interval

	USES= bison:build compiler:c++11-lang gmake perl5
	diff --git a/math/gmp/Makefile b/math/gmp/Makefile
	--- a/math/gmp/Makefile
	+++ b/math/gmp/Makefile
	@@ -31,10 +31,6 @@

	.include <bsd.port.pre.mk>

	-.if ${ARCH:Mmips*}
	-MAKE_JOBS_UNSAFE=yes
	-.endif
	-
	.if ! ${PORT_OPTIONS:MCPU_OPTS}
	CONFIGURE_ARGS+=--build=${CONFIGURE_TARGET}
	.elif ${ARCH:S/64//} != ${ARCH}
	diff --git a/math/gretl/Makefile b/math/gretl/Makefile
	--- a/math/gretl/Makefile
	+++ b/math/gretl/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_FreeBSD_13= configure fails: checking for gnuplot >= 5.2 with cairo support... no
	-
	LIB_DEPENDS= libcurl.so:ftp/curl \
	libfftw3.so:math/fftw3 \
	libgmp.so:math/gmp \
	diff --git a/math/lean4/Makefile b/math/lean4/Makefile
	--- a/math/lean4/Makefile
	+++ b/math/lean4/Makefile
	@@ -12,7 +12,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= compilation fails: error: use of undeclared identifier 'clearenv'
	BROKEN_armv7= compilation fails: ../../.build/stage1/lib/temp/Init/Coe.depend: No such file or directory
	BROKEN_i386= linking fails: INTERNAL PANIC: out of memory (during: Linking runLinter)

	diff --git a/math/lp_solve/Makefile b/math/lp_solve/Makefile
	--- a/math/lp_solve/Makefile
	+++ b/math/lp_solve/Makefile
	@@ -19,7 +19,7 @@

	.include <bsd.port.pre.mk>

	-.if ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| ${ARCH} == mips \|\| \
	+.if ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| \
	${ARCH} == powerpc \|\| ${ARCH} == powerpcspe
	LPSOLVE_ARCH= ux32
	.else
	diff --git a/math/onednn/Makefile b/math/onednn/Makefile
	--- a/math/onednn/Makefile
	+++ b/math/onednn/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	BROKEN_aarch64= error: sys/prctl.h file not found
	.if !exists(/usr/include/omp.h)
	BROKEN= requires OpenMP support that is missing on this architecture
	diff --git a/math/onednn252/Makefile b/math/onednn252/Makefile
	--- a/math/onednn252/Makefile
	+++ b/math/onednn252/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	BROKEN_aarch64= error: sys/prctl.h file not found
	.if !exists(/usr/include/omp.h)
	BROKEN= requires OpenMP support that is missing on this architecture
	diff --git a/math/pari/Makefile b/math/pari/Makefile
	--- a/math/pari/Makefile
	+++ b/math/pari/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips64= fails to link: mpker.c:(.text+0x33bc): relocation truncated to fit: R_MIPS_TLS_GD against 'PARI_SIGINT_block'
	-
	LIB_DEPENDS= libgmp.so:math/gmp

	USES= bison perl5 readline
	diff --git a/misc/free42/files/patch-gtk_build-intel-lib.sh b/misc/free42/files/patch-gtk_build-intel-lib.sh
	--- a/misc/free42/files/patch-gtk_build-intel-lib.sh
	+++ b/misc/free42/files/patch-gtk_build-intel-lib.sh
	@@ -17,11 +17,11 @@
	-case `uname -m` in
	- armv7\|armv7l\|i386\|ppc)
	+case `uname -p` in
	-+ armv6\|armv7\|armv7l\|i386\|ppc\|powerpc\|powerpcspe\|mips)
	++ armv6\|armv7\|armv7l\|i386\|ppc\|powerpc\|powerpcspe)
	patch -p0 <../intel-lib-unknown-32bit.patch
	;;
	- aarch64\|arm64\|i86pc)
	-+ aarch64\|arm64\|i86pc\|powerpc64\|powerpc64le\|mips64\|riscv64)
	++ aarch64\|arm64\|i86pc\|powerpc64\|powerpc64le\|riscv64)
	patch -p0 <../intel-lib-unknown-64bit.patch
	;;
	esac
	diff --git a/misc/libpostal/Makefile b/misc/libpostal/Makefile
	--- a/misc/libpostal/Makefile
	+++ b/misc/libpostal/Makefile
	@@ -15,9 +15,6 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_mips= fails to compile: tagger.h:5: redefinition of typedef 'tagger_feature_function'
	-BROKEN_mips64= fails to compile: tagger.h:5: redefinition of typedef 'tagger_feature_function'
	-
	RUN_DEPENDS= curl:ftp/curl

	USES= autoreconf libtool localbase
	diff --git a/misc/mtx/Makefile b/misc/mtx/Makefile
	--- a/misc/mtx/Makefile
	+++ b/misc/mtx/Makefile
	@@ -19,12 +19,6 @@
	share/man/man1/loaderinfo.1.gz share/man/man1/mtx.1.gz share/man/man1/tapeinfo.1.gz \
	share/man/man1/scsitape.1.gz share/man/man1/scsieject.1.gz

	-.include <bsd.port.options.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079
	-EXTRA_PATCHES= ${PATCHDIR}/extra-patch-FreeBSD_14
	-.endif
	-
	post-patch:
	${REINPLACE_CMD} -e 's\|@prefix@\|${STAGEDIR}${PREFIX}\|g' \
	${WRKSRC}/Makefile.in
	diff --git a/misc/mtx/files/patch-mtx.h b/misc/mtx/files/patch-mtx.h
	new file mode 100644
	--- /dev/null
	+++ b/misc/mtx/files/patch-mtx.h
	@@ -0,0 +1,358 @@
	+--- mtx.h.orig 2023-06-08 15:05:44 UTC
	++++ mtx.h
	+@@ -7,7 +7,7 @@
	+
	+ $Date: 2008-08-19 03:03:38 -0700 (Tue, 19 Aug 2008) $
	+ $Revision: 193 $
	+- See mtx.c for licensing information.
	++ See mtx.c for licensing information.
	+
	+ */
	+
	+@@ -68,6 +68,9 @@
	+ # include <sys/param.h>
	+ #endif
	+
	++#if HAVE_STDBOOL_H
	++#include <stdbool.h>
	++#endif
	+ /* Now greatly modified to use GNU Autoconf stuff: */
	+ /* If we use the 'sg' interface, like Linux, do this: */
	+ #if HAVE_SCSI_SG_H
	+@@ -148,7 +151,7 @@ typedef dsreq_t DEVICE_TYPE; / 64-bit pointers/32bit
	+ #endif /* VMS protect. */
	+
	+ /* Do a test for LITTLE_ENDIAN_BITFIELDS. Use WORDS_BIGENDIAN as set
	+- * by configure:
	++ * by configure:
	+ */
	+
	+ #if WORDS_BIGENDIAN
	+@@ -183,7 +186,7 @@ typedef dsreq_t DEVICE_TYPE; / 64-bit pointers/32bit
	+ #undef S_VOLUME_OVERFLOW
	+ #endif
	+
	+-/* Note: These are only used for defaults for when we don't have
	++/* Note: These are only used for defaults for when we don't have
	+ * the element assignment mode page to tell us real amount...
	+ */
	+ #define MAX_STORAGE_ELEMENTS 64 /* for the BIG jukeboxes! */
	+@@ -212,18 +215,11 @@ typedef struct SCSI_Flags_Struct
	+ } SCSI_Flags_T;
	+
	+ #ifdef _MSC_VER
	+-typedef unsigned char boolean;
	+-
	+-#define false 0
	+-#define true 1
	+-
	+ typedef unsigned char Direction_T;
	+
	+ #define Input 0
	+ #define Output 1
	+ #else
	+-typedef enum { false, true } boolean;
	+-
	+ typedef enum { Input, Output } Direction_T;
	+ #endif
	+
	+@@ -237,66 +233,66 @@ typedef struct Inquiry
	+ unsigned char PeripheralDeviceType:5; /* Byte 0 Bits 0-4 */
	+ unsigned char PeripheralQualifier:3; /* Byte 0 Bits 5-7 */
	+ unsigned char DeviceTypeModifier:7; /* Byte 1 Bits 0-6 */
	+- boolean RMB:1; /* Byte 1 Bit 7 */
	++ bool RMB:1; /* Byte 1 Bit 7 */
	+ unsigned char ANSI_ApprovedVersion:3; /* Byte 2 Bits 0-2 */
	+ unsigned char ECMA_Version:3; /* Byte 2 Bits 3-5 */
	+ unsigned char ISO_Version:2; /* Byte 2 Bits 6-7 */
	+ unsigned char ResponseDataFormat:4; /* Byte 3 Bits 0-3 */
	+ unsigned char :2; /* Byte 3 Bits 4-5 */
	+- boolean TrmIOP:1; /* Byte 3 Bit 6 */
	+- boolean AENC:1; /* Byte 3 Bit 7 */
	++ bool TrmIOP:1; /* Byte 3 Bit 6 */
	++ bool AENC:1; /* Byte 3 Bit 7 */
	+ #else
	+ unsigned char PeripheralQualifier:3; /* Byte 0 Bits 5-7 */
	+ unsigned char PeripheralDeviceType:5; /* Byte 0 Bits 0-4 */
	+- boolean RMB:1; /* Byte 1 Bit 7 */
	++ bool RMB:1; /* Byte 1 Bit 7 */
	+ unsigned char DeviceTypeModifier:7; /* Byte 1 Bits 0-6 */
	+ unsigned char ISO_Version:2; /* Byte 2 Bits 6-7 */
	+ unsigned char ECMA_Version:3; /* Byte 2 Bits 3-5 */
	+ unsigned char ANSI_ApprovedVersion:3; /* Byte 2 Bits 0-2 */
	+- boolean AENC:1; /* Byte 3 Bit 7 */
	+- boolean TrmIOP:1; /* Byte 3 Bit 6 */
	++ bool AENC:1; /* Byte 3 Bit 7 */
	++ bool TrmIOP:1; /* Byte 3 Bit 6 */
	+ unsigned char :2; /* Byte 3 Bits 4-5 */
	+ unsigned char ResponseDataFormat:4; /* Byte 3 Bits 0-3 */
	+ #endif
	+ unsigned char AdditionalLength; /* Byte 4 */
	+ unsigned char :8; /* Byte 5 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+- boolean ADDR16:1; /* Byte 6 bit 0 */
	+- boolean Obs6_1:1; /* Byte 6 bit 1 */
	+- boolean Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	+- boolean MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	+- boolean MultiP:1; /* Byte 6 bit 4 */
	+- boolean VS:1; /* Byte 6 bit 5 */
	+- boolean EncServ:1; /* Byte 6 bit 6 */
	+- boolean BQue:1; /* Byte 6 bit 7 */
	++ bool ADDR16:1; /* Byte 6 bit 0 */
	++ bool Obs6_1:1; /* Byte 6 bit 1 */
	++ bool Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	++ bool MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	++ bool MultiP:1; /* Byte 6 bit 4 */
	++ bool VS:1; /* Byte 6 bit 5 */
	++ bool EncServ:1; /* Byte 6 bit 6 */
	++ bool BQue:1; /* Byte 6 bit 7 */
	+ #else
	+- boolean BQue:1; /* Byte 6 bit 7 */
	+- boolean EncServ:1; /* Byte 6 bit 6 */
	+- boolean VS:1; /* Byte 6 bit 5 */
	+- boolean MultiP:1; /* Byte 6 bit 4 */
	+- boolean MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	+- boolean Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	+- boolean Obs6_1:1; /* Byte 6 bit 1 */
	+- boolean ADDR16:1; /* Byte 6 bit 0 */
	++ bool BQue:1; /* Byte 6 bit 7 */
	++ bool EncServ:1; /* Byte 6 bit 6 */
	++ bool VS:1; /* Byte 6 bit 5 */
	++ bool MultiP:1; /* Byte 6 bit 4 */
	++ bool MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	++ bool Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	++ bool Obs6_1:1; /* Byte 6 bit 1 */
	++ bool ADDR16:1; /* Byte 6 bit 0 */
	+ #endif
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+- boolean SftRe:1; /* Byte 7 Bit 0 */
	+- boolean CmdQue:1; /* Byte 7 Bit 1 */
	+- boolean :1; /* Byte 7 Bit 2 */
	+- boolean Linked:1; /* Byte 7 Bit 3 */
	+- boolean Sync:1; /* Byte 7 Bit 4 */
	+- boolean WBus16:1; /* Byte 7 Bit 5 */
	+- boolean WBus32:1; /* Byte 7 Bit 6 */
	+- boolean RelAdr:1; /* Byte 7 Bit 7 */
	++ bool SftRe:1; /* Byte 7 Bit 0 */
	++ bool CmdQue:1; /* Byte 7 Bit 1 */
	++ bool :1; /* Byte 7 Bit 2 */
	++ bool Linked:1; /* Byte 7 Bit 3 */
	++ bool Sync:1; /* Byte 7 Bit 4 */
	++ bool WBus16:1; /* Byte 7 Bit 5 */
	++ bool WBus32:1; /* Byte 7 Bit 6 */
	++ bool RelAdr:1; /* Byte 7 Bit 7 */
	+ #else
	+- boolean RelAdr:1; /* Byte 7 Bit 7 */
	+- boolean WBus32:1; /* Byte 7 Bit 6 */
	+- boolean WBus16:1; /* Byte 7 Bit 5 */
	+- boolean Sync:1; /* Byte 7 Bit 4 */
	+- boolean Linked:1; /* Byte 7 Bit 3 */
	+- boolean :1; /* Byte 7 Bit 2 */
	+- boolean CmdQue:1; /* Byte 7 Bit 1 */
	+- boolean SftRe:1; /* Byte 7 Bit 0 */
	++ bool RelAdr:1; /* Byte 7 Bit 7 */
	++ bool WBus32:1; /* Byte 7 Bit 6 */
	++ bool WBus16:1; /* Byte 7 Bit 5 */
	++ bool Sync:1; /* Byte 7 Bit 4 */
	++ bool Linked:1; /* Byte 7 Bit 3 */
	++ bool :1; /* Byte 7 Bit 2 */
	++ bool CmdQue:1; /* Byte 7 Bit 1 */
	++ bool SftRe:1; /* Byte 7 Bit 0 */
	+ #endif
	+ unsigned char VendorIdentification[8]; /* Bytes 8-15 */
	+ unsigned char ProductIdentification[16]; /* Bytes 16-31 */
	+@@ -319,22 +315,22 @@ typedef struct RequestSense
	+ {
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char ErrorCode:7; /* Byte 0 Bits 0-6 */
	+- boolean Valid:1; /* Byte 0 Bit 7 */
	++ bool Valid:1; /* Byte 0 Bit 7 */
	+ #else
	+- boolean Valid:1; /* Byte 0 Bit 7 */
	++ bool Valid:1; /* Byte 0 Bit 7 */
	+ unsigned char ErrorCode:7; /* Byte 0 Bits 0-6 */
	+ #endif
	+ unsigned char SegmentNumber; /* Byte 1 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char SenseKey:4; /* Byte 2 Bits 0-3 */
	+ unsigned char :1; /* Byte 2 Bit 4 */
	+- boolean ILI:1; /* Byte 2 Bit 5 */
	+- boolean EOM:1; /* Byte 2 Bit 6 */
	+- boolean Filemark:1; /* Byte 2 Bit 7 */
	++ bool ILI:1; /* Byte 2 Bit 5 */
	++ bool EOM:1; /* Byte 2 Bit 6 */
	++ bool Filemark:1; /* Byte 2 Bit 7 */
	+ #else
	+- boolean Filemark:1; /* Byte 2 Bit 7 */
	+- boolean EOM:1; /* Byte 2 Bit 6 */
	+- boolean ILI:1; /* Byte 2 Bit 5 */
	++ bool Filemark:1; /* Byte 2 Bit 7 */
	++ bool EOM:1; /* Byte 2 Bit 6 */
	++ bool ILI:1; /* Byte 2 Bit 5 */
	+ unsigned char :1; /* Byte 2 Bit 4 */
	+ unsigned char SenseKey:4; /* Byte 2 Bits 0-3 */
	+ #endif
	+@@ -346,15 +342,15 @@ typedef struct RequestSense
	+ unsigned char :8; /* Byte 14 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char BitPointer:3; /* Byte 15 */
	+- boolean BPV:1;
	++ bool BPV:1;
	+ unsigned char :2;
	+- boolean CommandData :1;
	+- boolean SKSV:1;
	++ bool CommandData :1;
	++ bool SKSV:1;
	+ #else
	+- boolean SKSV:1;
	+- boolean CommandData :1;
	++ bool SKSV:1;
	++ bool CommandData :1;
	+ unsigned char :2;
	+- boolean BPV:1;
	++ bool BPV:1;
	+ unsigned char BitPointer:3; /* Byte 15 */
	+ #endif
	+ unsigned char FieldData[2]; /* Byte 16,17 */
	+@@ -436,11 +432,11 @@ typedef struct ElementStatusPage
	+ ElementTypeCode_T ElementTypeCode:8; /* Byte 0 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char :6; /* Byte 1 Bits 0-5 */
	+- boolean AVolTag:1; /* Byte 1 Bit 6 */
	+- boolean PVolTag:1; /* Byte 1 Bit 7 */
	++ bool AVolTag:1; /* Byte 1 Bit 6 */
	++ bool PVolTag:1; /* Byte 1 Bit 7 */
	+ #else
	+- boolean PVolTag:1; /* Byte 1 Bit 7 */
	+- boolean AVolTag:1; /* Byte 1 Bit 6 */
	++ bool PVolTag:1; /* Byte 1 Bit 7 */
	++ bool AVolTag:1; /* Byte 1 Bit 6 */
	+ unsigned char :6; /* Byte 1 Bits 0-5 */
	+ #endif
	+ unsigned char ElementDescriptorLength[2]; /* Bytes 2-3 */
	+@@ -467,15 +463,15 @@ typedef struct TransportElementDescriptorShort
	+ {
	+ unsigned char ElementAddress[2]; /* Bytes 0-1 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+- boolean Full:1; /* Byte 2 Bit 0 */
	++ bool Full:1; /* Byte 2 Bit 0 */
	+ unsigned char :1; /* Byte 2 Bit 1 */
	+- boolean Except:1; /* Byte 2 Bit 2 */
	++ bool Except:1; /* Byte 2 Bit 2 */
	+ unsigned char :5; /* Byte 2 Bits 3-7 */
	+ #else
	+ unsigned char :5; /* Byte 2 Bits 3-7 */
	+- boolean Except:1; /* Byte 2 Bit 2 */
	++ bool Except:1; /* Byte 2 Bit 2 */
	+ unsigned char :1; /* Byte 2 Bit 1 */
	+- boolean Full:1; /* Byte 2 Bit 0 */
	++ bool Full:1; /* Byte 2 Bit 0 */
	+ #endif
	+ unsigned char :8; /* Byte 3 */
	+ unsigned char AdditionalSenseCode; /* Byte 4 */
	+@@ -485,11 +481,11 @@ typedef struct TransportElementDescriptorShort
	+ unsigned char :8; /* Byte 8 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char :6; /* Byte 9 Bits 0-5 */
	+- boolean SValid:1; /* Byte 9 Bit 6 */
	+- boolean Invert:1; /* Byte 9 Bit 7 */
	++ bool SValid:1; /* Byte 9 Bit 6 */
	++ bool Invert:1; /* Byte 9 Bit 7 */
	+ #else
	+- boolean Invert:1; /* Byte 9 Bit 7 */
	+- boolean SValid:1; /* Byte 9 Bit 6 */
	++ bool Invert:1; /* Byte 9 Bit 7 */
	++ bool SValid:1; /* Byte 9 Bit 6 */
	+ unsigned char :6; /* Byte 9 Bits 0-5 */
	+ #endif
	+ unsigned char SourceStorageElementAddress[2]; /* Bytes 10-11 */
	+@@ -504,15 +500,15 @@ typedef struct TransportElementDescriptor
	+ {
	+ unsigned char ElementAddress[2]; /* Bytes 0-1 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+- boolean Full:1; /* Byte 2 Bit 0 */
	++ bool Full:1; /* Byte 2 Bit 0 */
	+ unsigned char :1; /* Byte 2 Bit 1 */
	+- boolean Except:1; /* Byte 2 Bit 2 */
	++ bool Except:1; /* Byte 2 Bit 2 */
	+ unsigned char :5; /* Byte 2 Bits 3-7 */
	+ #else
	+ unsigned char :5; /* Byte 2 Bits 3-7 */
	+- boolean Except:1; /* Byte 2 Bit 2 */
	++ bool Except:1; /* Byte 2 Bit 2 */
	+ unsigned char :1; /* Byte 2 Bit 1 */
	+- boolean Full:1; /* Byte 2 Bit 0 */
	++ bool Full:1; /* Byte 2 Bit 0 */
	+ #endif
	+ unsigned char :8; /* Byte 3 */
	+ unsigned char AdditionalSenseCode; /* Byte 4 */
	+@@ -522,20 +518,20 @@ typedef struct TransportElementDescriptor
	+ unsigned char :8; /* Byte 8 */
	+ #ifdef LITTLE_ENDIAN_BITFIELDS
	+ unsigned char :6; /* Byte 9 Bits 0-5 */
	+- boolean SValid:1; /* Byte 9 Bit 6 */
	+- boolean Invert:1; /* Byte 9 Bit 7 */
	++ bool SValid:1; /* Byte 9 Bit 6 */
	++ bool Invert:1; /* Byte 9 Bit 7 */
	+ #else
	+- boolean Invert:1; /* Byte 9 Bit 7 */
	+- boolean SValid:1; /* Byte 9 Bit 6 */
	++ bool Invert:1; /* Byte 9 Bit 7 */
	++ bool SValid:1; /* Byte 9 Bit 6 */
	+ unsigned char :6; /* Byte 9 Bits 0-5 */
	+ #endif
	+ unsigned char SourceStorageElementAddress[2]; /* Bytes 10-11 */
	+ unsigned char PrimaryVolumeTag[36]; /* barcode */
	+- unsigned char AlternateVolumeTag[36];
	++ unsigned char AlternateVolumeTag[36];
	+ #ifdef HAS_LONG_DESCRIPTORS
	+ unsigned char Reserved[4]; /* 4 extra bytes? */
	+ #endif
	+-
	++
	+ }
	+ TransportElementDescriptor_T;
	+
	+@@ -558,12 +554,12 @@ typedef struct ElementStatus {
	+ barcode PrimaryVolumeTag; / array */
	+ barcode AlternateVolumeTag; / array */
	+ int StorageElementAddress; / array */
	+- boolean StorageElementIsImportExport; / array */
	++ bool StorageElementIsImportExport; / array */
	+
	+ int TransportElementAddress; /* assume only one of those... */
	+
	+- boolean DataTransferElementFull; / array */
	+- boolean StorageElementFull; / array */
	++ bool DataTransferElementFull; / array */
	++ bool StorageElementFull; / array */
	+
	+ } ElementStatus_T;
	+
	+@@ -577,7 +573,7 @@ typedef struct scsi_id {
	+ #define MEDIUM_CHANGER_TYPE 8 /* what type bits are set for medium changers. */
	+
	+ /* The following two structs are used for the brain-dead functions of the
	+- * NSM jukebox.
	++ * NSM jukebox.
	+ */
	+
	+ typedef struct NSM_Param {
	+@@ -592,7 +588,7 @@ typedef struct NSM_Param {
	+ unsigned char command_params[2048]; /* egregious overkill. */
	+ } NSM_Param_T;
	+
	+-extern RequestSense_T scsi_error_sense;
	++extern RequestSense_T scsi_error_sense;
	+
	+ typedef struct NSM_Result {
	+ unsigned char page_code;
	+@@ -600,7 +596,7 @@ typedef struct NSM_Result {
	+ unsigned char page_len_msb;
	+ unsigned char page_len_lsb;
	+ unsigned char command_code[4];
	+- unsigned char ces_code[2];
	++ unsigned char ces_code[2];
	+ unsigned char return_data[0xffff]; /* egregioius overkill */
	+ } NSM_Result_T;
	+
	diff --git a/misc/mtx/files/extra-patch-FreeBSD_14 b/misc/mtx/files/patch-mtx1.c
	rename from misc/mtx/files/extra-patch-FreeBSD_14
	rename to misc/mtx/files/patch-mtx1.c
	--- a/misc/mtx/files/extra-patch-FreeBSD_14
	+++ b/misc/mtx/files/patch-mtx1.c
	@@ -1,361 +1,3 @@
	---- mtx.h.orig 2023-06-08 15:05:44 UTC
	-+++ mtx.h
	-@@ -7,7 +7,7 @@
	-
	- $Date: 2008-08-19 03:03:38 -0700 (Tue, 19 Aug 2008) $
	- $Revision: 193 $
	-- See mtx.c for licensing information.
	-+ See mtx.c for licensing information.
	-
	- */
	-
	-@@ -68,6 +68,9 @@
	- # include <sys/param.h>
	- #endif
	-
	-+#if HAVE_STDBOOL_H
	-+#include <stdbool.h>
	-+#endif
	- /* Now greatly modified to use GNU Autoconf stuff: */
	- /* If we use the 'sg' interface, like Linux, do this: */
	- #if HAVE_SCSI_SG_H
	-@@ -148,7 +151,7 @@ typedef dsreq_t DEVICE_TYPE; / 64-bit pointers/32bit
	- #endif /* VMS protect. */
	-
	- /* Do a test for LITTLE_ENDIAN_BITFIELDS. Use WORDS_BIGENDIAN as set
	-- * by configure:
	-+ * by configure:
	- */
	-
	- #if WORDS_BIGENDIAN
	-@@ -183,7 +186,7 @@ typedef dsreq_t DEVICE_TYPE; / 64-bit pointers/32bit
	- #undef S_VOLUME_OVERFLOW
	- #endif
	-
	--/* Note: These are only used for defaults for when we don't have
	-+/* Note: These are only used for defaults for when we don't have
	- * the element assignment mode page to tell us real amount...
	- */
	- #define MAX_STORAGE_ELEMENTS 64 /* for the BIG jukeboxes! */
	-@@ -212,18 +215,11 @@ typedef struct SCSI_Flags_Struct
	- } SCSI_Flags_T;
	-
	- #ifdef _MSC_VER
	--typedef unsigned char boolean;
	--
	--#define false 0
	--#define true 1
	--
	- typedef unsigned char Direction_T;
	-
	- #define Input 0
	- #define Output 1
	- #else
	--typedef enum { false, true } boolean;
	--
	- typedef enum { Input, Output } Direction_T;
	- #endif
	-
	-@@ -237,66 +233,66 @@ typedef struct Inquiry
	- unsigned char PeripheralDeviceType:5; /* Byte 0 Bits 0-4 */
	- unsigned char PeripheralQualifier:3; /* Byte 0 Bits 5-7 */
	- unsigned char DeviceTypeModifier:7; /* Byte 1 Bits 0-6 */
	-- boolean RMB:1; /* Byte 1 Bit 7 */
	-+ bool RMB:1; /* Byte 1 Bit 7 */
	- unsigned char ANSI_ApprovedVersion:3; /* Byte 2 Bits 0-2 */
	- unsigned char ECMA_Version:3; /* Byte 2 Bits 3-5 */
	- unsigned char ISO_Version:2; /* Byte 2 Bits 6-7 */
	- unsigned char ResponseDataFormat:4; /* Byte 3 Bits 0-3 */
	- unsigned char :2; /* Byte 3 Bits 4-5 */
	-- boolean TrmIOP:1; /* Byte 3 Bit 6 */
	-- boolean AENC:1; /* Byte 3 Bit 7 */
	-+ bool TrmIOP:1; /* Byte 3 Bit 6 */
	-+ bool AENC:1; /* Byte 3 Bit 7 */
	- #else
	- unsigned char PeripheralQualifier:3; /* Byte 0 Bits 5-7 */
	- unsigned char PeripheralDeviceType:5; /* Byte 0 Bits 0-4 */
	-- boolean RMB:1; /* Byte 1 Bit 7 */
	-+ bool RMB:1; /* Byte 1 Bit 7 */
	- unsigned char DeviceTypeModifier:7; /* Byte 1 Bits 0-6 */
	- unsigned char ISO_Version:2; /* Byte 2 Bits 6-7 */
	- unsigned char ECMA_Version:3; /* Byte 2 Bits 3-5 */
	- unsigned char ANSI_ApprovedVersion:3; /* Byte 2 Bits 0-2 */
	-- boolean AENC:1; /* Byte 3 Bit 7 */
	-- boolean TrmIOP:1; /* Byte 3 Bit 6 */
	-+ bool AENC:1; /* Byte 3 Bit 7 */
	-+ bool TrmIOP:1; /* Byte 3 Bit 6 */
	- unsigned char :2; /* Byte 3 Bits 4-5 */
	- unsigned char ResponseDataFormat:4; /* Byte 3 Bits 0-3 */
	- #endif
	- unsigned char AdditionalLength; /* Byte 4 */
	- unsigned char :8; /* Byte 5 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	-- boolean ADDR16:1; /* Byte 6 bit 0 */
	-- boolean Obs6_1:1; /* Byte 6 bit 1 */
	-- boolean Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	-- boolean MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	-- boolean MultiP:1; /* Byte 6 bit 4 */
	-- boolean VS:1; /* Byte 6 bit 5 */
	-- boolean EncServ:1; /* Byte 6 bit 6 */
	-- boolean BQue:1; /* Byte 6 bit 7 */
	-+ bool ADDR16:1; /* Byte 6 bit 0 */
	-+ bool Obs6_1:1; /* Byte 6 bit 1 */
	-+ bool Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	-+ bool MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	-+ bool MultiP:1; /* Byte 6 bit 4 */
	-+ bool VS:1; /* Byte 6 bit 5 */
	-+ bool EncServ:1; /* Byte 6 bit 6 */
	-+ bool BQue:1; /* Byte 6 bit 7 */
	- #else
	-- boolean BQue:1; /* Byte 6 bit 7 */
	-- boolean EncServ:1; /* Byte 6 bit 6 */
	-- boolean VS:1; /* Byte 6 bit 5 */
	-- boolean MultiP:1; /* Byte 6 bit 4 */
	-- boolean MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	-- boolean Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	-- boolean Obs6_1:1; /* Byte 6 bit 1 */
	-- boolean ADDR16:1; /* Byte 6 bit 0 */
	-+ bool BQue:1; /* Byte 6 bit 7 */
	-+ bool EncServ:1; /* Byte 6 bit 6 */
	-+ bool VS:1; /* Byte 6 bit 5 */
	-+ bool MultiP:1; /* Byte 6 bit 4 */
	-+ bool MChngr:1; /* Media Changer / / Byte 6 bit 3 */
	-+ bool Obs6_2:1; /* obsolete / / Byte 6 bit 2 */
	-+ bool Obs6_1:1; /* Byte 6 bit 1 */
	-+ bool ADDR16:1; /* Byte 6 bit 0 */
	- #endif
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	-- boolean SftRe:1; /* Byte 7 Bit 0 */
	-- boolean CmdQue:1; /* Byte 7 Bit 1 */
	-- boolean :1; /* Byte 7 Bit 2 */
	-- boolean Linked:1; /* Byte 7 Bit 3 */
	-- boolean Sync:1; /* Byte 7 Bit 4 */
	-- boolean WBus16:1; /* Byte 7 Bit 5 */
	-- boolean WBus32:1; /* Byte 7 Bit 6 */
	-- boolean RelAdr:1; /* Byte 7 Bit 7 */
	-+ bool SftRe:1; /* Byte 7 Bit 0 */
	-+ bool CmdQue:1; /* Byte 7 Bit 1 */
	-+ bool :1; /* Byte 7 Bit 2 */
	-+ bool Linked:1; /* Byte 7 Bit 3 */
	-+ bool Sync:1; /* Byte 7 Bit 4 */
	-+ bool WBus16:1; /* Byte 7 Bit 5 */
	-+ bool WBus32:1; /* Byte 7 Bit 6 */
	-+ bool RelAdr:1; /* Byte 7 Bit 7 */
	- #else
	-- boolean RelAdr:1; /* Byte 7 Bit 7 */
	-- boolean WBus32:1; /* Byte 7 Bit 6 */
	-- boolean WBus16:1; /* Byte 7 Bit 5 */
	-- boolean Sync:1; /* Byte 7 Bit 4 */
	-- boolean Linked:1; /* Byte 7 Bit 3 */
	-- boolean :1; /* Byte 7 Bit 2 */
	-- boolean CmdQue:1; /* Byte 7 Bit 1 */
	-- boolean SftRe:1; /* Byte 7 Bit 0 */
	-+ bool RelAdr:1; /* Byte 7 Bit 7 */
	-+ bool WBus32:1; /* Byte 7 Bit 6 */
	-+ bool WBus16:1; /* Byte 7 Bit 5 */
	-+ bool Sync:1; /* Byte 7 Bit 4 */
	-+ bool Linked:1; /* Byte 7 Bit 3 */
	-+ bool :1; /* Byte 7 Bit 2 */
	-+ bool CmdQue:1; /* Byte 7 Bit 1 */
	-+ bool SftRe:1; /* Byte 7 Bit 0 */
	- #endif
	- unsigned char VendorIdentification[8]; /* Bytes 8-15 */
	- unsigned char ProductIdentification[16]; /* Bytes 16-31 */
	-@@ -319,22 +315,22 @@ typedef struct RequestSense
	- {
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char ErrorCode:7; /* Byte 0 Bits 0-6 */
	-- boolean Valid:1; /* Byte 0 Bit 7 */
	-+ bool Valid:1; /* Byte 0 Bit 7 */
	- #else
	-- boolean Valid:1; /* Byte 0 Bit 7 */
	-+ bool Valid:1; /* Byte 0 Bit 7 */
	- unsigned char ErrorCode:7; /* Byte 0 Bits 0-6 */
	- #endif
	- unsigned char SegmentNumber; /* Byte 1 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char SenseKey:4; /* Byte 2 Bits 0-3 */
	- unsigned char :1; /* Byte 2 Bit 4 */
	-- boolean ILI:1; /* Byte 2 Bit 5 */
	-- boolean EOM:1; /* Byte 2 Bit 6 */
	-- boolean Filemark:1; /* Byte 2 Bit 7 */
	-+ bool ILI:1; /* Byte 2 Bit 5 */
	-+ bool EOM:1; /* Byte 2 Bit 6 */
	-+ bool Filemark:1; /* Byte 2 Bit 7 */
	- #else
	-- boolean Filemark:1; /* Byte 2 Bit 7 */
	-- boolean EOM:1; /* Byte 2 Bit 6 */
	-- boolean ILI:1; /* Byte 2 Bit 5 */
	-+ bool Filemark:1; /* Byte 2 Bit 7 */
	-+ bool EOM:1; /* Byte 2 Bit 6 */
	-+ bool ILI:1; /* Byte 2 Bit 5 */
	- unsigned char :1; /* Byte 2 Bit 4 */
	- unsigned char SenseKey:4; /* Byte 2 Bits 0-3 */
	- #endif
	-@@ -346,15 +342,15 @@ typedef struct RequestSense
	- unsigned char :8; /* Byte 14 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char BitPointer:3; /* Byte 15 */
	-- boolean BPV:1;
	-+ bool BPV:1;
	- unsigned char :2;
	-- boolean CommandData :1;
	-- boolean SKSV:1;
	-+ bool CommandData :1;
	-+ bool SKSV:1;
	- #else
	-- boolean SKSV:1;
	-- boolean CommandData :1;
	-+ bool SKSV:1;
	-+ bool CommandData :1;
	- unsigned char :2;
	-- boolean BPV:1;
	-+ bool BPV:1;
	- unsigned char BitPointer:3; /* Byte 15 */
	- #endif
	- unsigned char FieldData[2]; /* Byte 16,17 */
	-@@ -436,11 +432,11 @@ typedef struct ElementStatusPage
	- ElementTypeCode_T ElementTypeCode:8; /* Byte 0 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char :6; /* Byte 1 Bits 0-5 */
	-- boolean AVolTag:1; /* Byte 1 Bit 6 */
	-- boolean PVolTag:1; /* Byte 1 Bit 7 */
	-+ bool AVolTag:1; /* Byte 1 Bit 6 */
	-+ bool PVolTag:1; /* Byte 1 Bit 7 */
	- #else
	-- boolean PVolTag:1; /* Byte 1 Bit 7 */
	-- boolean AVolTag:1; /* Byte 1 Bit 6 */
	-+ bool PVolTag:1; /* Byte 1 Bit 7 */
	-+ bool AVolTag:1; /* Byte 1 Bit 6 */
	- unsigned char :6; /* Byte 1 Bits 0-5 */
	- #endif
	- unsigned char ElementDescriptorLength[2]; /* Bytes 2-3 */
	-@@ -467,15 +463,15 @@ typedef struct TransportElementDescriptorShort
	- {
	- unsigned char ElementAddress[2]; /* Bytes 0-1 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	-- boolean Full:1; /* Byte 2 Bit 0 */
	-+ bool Full:1; /* Byte 2 Bit 0 */
	- unsigned char :1; /* Byte 2 Bit 1 */
	-- boolean Except:1; /* Byte 2 Bit 2 */
	-+ bool Except:1; /* Byte 2 Bit 2 */
	- unsigned char :5; /* Byte 2 Bits 3-7 */
	- #else
	- unsigned char :5; /* Byte 2 Bits 3-7 */
	-- boolean Except:1; /* Byte 2 Bit 2 */
	-+ bool Except:1; /* Byte 2 Bit 2 */
	- unsigned char :1; /* Byte 2 Bit 1 */
	-- boolean Full:1; /* Byte 2 Bit 0 */
	-+ bool Full:1; /* Byte 2 Bit 0 */
	- #endif
	- unsigned char :8; /* Byte 3 */
	- unsigned char AdditionalSenseCode; /* Byte 4 */
	-@@ -485,11 +481,11 @@ typedef struct TransportElementDescriptorShort
	- unsigned char :8; /* Byte 8 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char :6; /* Byte 9 Bits 0-5 */
	-- boolean SValid:1; /* Byte 9 Bit 6 */
	-- boolean Invert:1; /* Byte 9 Bit 7 */
	-+ bool SValid:1; /* Byte 9 Bit 6 */
	-+ bool Invert:1; /* Byte 9 Bit 7 */
	- #else
	-- boolean Invert:1; /* Byte 9 Bit 7 */
	-- boolean SValid:1; /* Byte 9 Bit 6 */
	-+ bool Invert:1; /* Byte 9 Bit 7 */
	-+ bool SValid:1; /* Byte 9 Bit 6 */
	- unsigned char :6; /* Byte 9 Bits 0-5 */
	- #endif
	- unsigned char SourceStorageElementAddress[2]; /* Bytes 10-11 */
	-@@ -504,15 +500,15 @@ typedef struct TransportElementDescriptor
	- {
	- unsigned char ElementAddress[2]; /* Bytes 0-1 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	-- boolean Full:1; /* Byte 2 Bit 0 */
	-+ bool Full:1; /* Byte 2 Bit 0 */
	- unsigned char :1; /* Byte 2 Bit 1 */
	-- boolean Except:1; /* Byte 2 Bit 2 */
	-+ bool Except:1; /* Byte 2 Bit 2 */
	- unsigned char :5; /* Byte 2 Bits 3-7 */
	- #else
	- unsigned char :5; /* Byte 2 Bits 3-7 */
	-- boolean Except:1; /* Byte 2 Bit 2 */
	-+ bool Except:1; /* Byte 2 Bit 2 */
	- unsigned char :1; /* Byte 2 Bit 1 */
	-- boolean Full:1; /* Byte 2 Bit 0 */
	-+ bool Full:1; /* Byte 2 Bit 0 */
	- #endif
	- unsigned char :8; /* Byte 3 */
	- unsigned char AdditionalSenseCode; /* Byte 4 */
	-@@ -522,20 +518,20 @@ typedef struct TransportElementDescriptor
	- unsigned char :8; /* Byte 8 */
	- #ifdef LITTLE_ENDIAN_BITFIELDS
	- unsigned char :6; /* Byte 9 Bits 0-5 */
	-- boolean SValid:1; /* Byte 9 Bit 6 */
	-- boolean Invert:1; /* Byte 9 Bit 7 */
	-+ bool SValid:1; /* Byte 9 Bit 6 */
	-+ bool Invert:1; /* Byte 9 Bit 7 */
	- #else
	-- boolean Invert:1; /* Byte 9 Bit 7 */
	-- boolean SValid:1; /* Byte 9 Bit 6 */
	-+ bool Invert:1; /* Byte 9 Bit 7 */
	-+ bool SValid:1; /* Byte 9 Bit 6 */
	- unsigned char :6; /* Byte 9 Bits 0-5 */
	- #endif
	- unsigned char SourceStorageElementAddress[2]; /* Bytes 10-11 */
	- unsigned char PrimaryVolumeTag[36]; /* barcode */
	-- unsigned char AlternateVolumeTag[36];
	-+ unsigned char AlternateVolumeTag[36];
	- #ifdef HAS_LONG_DESCRIPTORS
	- unsigned char Reserved[4]; /* 4 extra bytes? */
	- #endif
	--
	-+
	- }
	- TransportElementDescriptor_T;
	-
	-@@ -558,12 +554,12 @@ typedef struct ElementStatus {
	- barcode PrimaryVolumeTag; / array */
	- barcode AlternateVolumeTag; / array */
	- int StorageElementAddress; / array */
	-- boolean StorageElementIsImportExport; / array */
	-+ bool StorageElementIsImportExport; / array */
	-
	- int TransportElementAddress; /* assume only one of those... */
	-
	-- boolean DataTransferElementFull; / array */
	-- boolean StorageElementFull; / array */
	-+ bool DataTransferElementFull; / array */
	-+ bool StorageElementFull; / array */
	-
	- } ElementStatus_T;
	-
	-@@ -577,7 +573,7 @@ typedef struct scsi_id {
	- #define MEDIUM_CHANGER_TYPE 8 /* what type bits are set for medium changers. */
	-
	- /* The following two structs are used for the brain-dead functions of the
	-- * NSM jukebox.
	-+ * NSM jukebox.
	- */
	-
	- typedef struct NSM_Param {
	-@@ -592,7 +588,7 @@ typedef struct NSM_Param {
	- unsigned char command_params[2048]; /* egregious overkill. */
	- } NSM_Param_T;
	-
	--extern RequestSense_T scsi_error_sense;
	-+extern RequestSense_T scsi_error_sense;
	-
	- typedef struct NSM_Result {
	- unsigned char page_code;
	-@@ -600,7 +596,7 @@ typedef struct NSM_Result {
	- unsigned char page_len_msb;
	- unsigned char page_len_lsb;
	- unsigned char command_code[4];
	-- unsigned char ces_code[2];
	-+ unsigned char ces_code[2];
	- unsigned char return_data[0xffff]; /* egregioius overkill */
	- } NSM_Result_T;
	-
	--- mtxl.c.orig 2023-06-08 15:12:53 UTC
	+++ mtxl.c
	@@ -23,7 +23,7 @@
	@@ -921,3 +563,4 @@
	msg = "Current" ;
	}
	else if (RequestSense->ErrorCode == 0x71)
	+
	diff --git a/misc/qman/Makefile b/misc/qman/Makefile
	--- a/misc/qman/Makefile
	+++ b/misc/qman/Makefile
	@@ -12,7 +12,7 @@

	BUILD_DEPENDS= cog:devel/py-cogapp

	-USES= groff:run meson pkgconfig
	+USES= groff:run meson ncurses pkgconfig

	USE_GITHUB= yes
	GH_ACCOUNT= plp13
	@@ -37,15 +37,6 @@
	PORTDOCS= BUILDING.md CONTRIBUTING.md DEBUGGING.md OS_SPECIFIC.md \
	README.md TESTING.md TROUBLESHOOTING.md

	-.include <bsd.port.options.mk>
	-
	-# FreeBSD 13 is missing /usr/libdata/pkgconfig/ncursesw.pc
	-.if ${OPSYS} == FreeBSD && ${OSREL:R} == 13
	-USES+= ncurses:port
	-.else
	-USES+= ncurses
	-.endif
	-
	post-patch:
	@${REINPLACE_CMD} -e 's\|%%LOCALBASE%%\|${LOCALBASE}\|' \
	${WRKSRC}/config/qman.conf
	diff --git a/misc/thrill/Makefile b/misc/thrill/Makefile
	--- a/misc/thrill/Makefile
	+++ b/misc/thrill/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= BSD2CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe # static_assert failed due to requirement 'sizeof(unsigned int) == 8' "FOXXLL supports only 64-bit builds"
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe # static_assert failed due to requirement 'sizeof(unsigned int) == 8' "FOXXLL supports only 64-bit builds"

	LIB_DEPENDS= libmpi_cxx.so:net/openmpi4

	diff --git a/multimedia/ab25/Makefile b/multimedia/ab25/Makefile
	--- a/multimedia/ab25/Makefile
	+++ b/multimedia/ab25/Makefile
	@@ -23,12 +23,6 @@

	OPTIONS_DEFINE= DOCS

	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} <= 1400079
	-PLIST_FILES+= lib/libab25_p.a
	-.endif
	-
	pre-install:
	@${MKDIR} ${STAGEDIR}${PREFIX}/include/ab25

	@@ -36,4 +30,4 @@
	@${MKDIR} ${STAGEDIR}${DOCSDIR}
	cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR}

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/multimedia/ffmpeg3/Makefile b/multimedia/ffmpeg3/Makefile
	--- a/multimedia/ffmpeg3/Makefile
	+++ b/multimedia/ffmpeg3/Makefile
	@@ -16,7 +16,7 @@
	LICENSE= GPLv2+ LGPL21+
	LICENSE_COMB= multi

	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= emulators/ppsspp only supports little-endian, see \
	https://github.com/hrydgard/ppsspp/issues/8823

	diff --git a/multimedia/gst123/Makefile b/multimedia/gst123/Makefile
	--- a/multimedia/gst123/Makefile
	+++ b/multimedia/gst123/Makefile
	@@ -23,15 +23,8 @@

	PLIST_FILES= bin/${PORTNAME} share/man/man1/${PORTNAME}.1.gz

	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
	-CONFIGURE_ENV= NCURSES_CFLAGS=-I${NCURSESINC} NCURSES_LIBS=-L${NCURSESLIB}
	-LDFLAGS+= ${TINFO_LIB}
	-.endif
	-
	do-install:
	${INSTALL_PROGRAM} ${WRKSRC}/src/${PORTNAME} ${STAGEDIR}${PREFIX}/bin
	${INSTALL_MAN} ${WRKSRC}/docs/${PORTNAME}.1 ${STAGEDIR}${PREFIX}/share/man/man1

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/multimedia/lms/Makefile b/multimedia/lms/Makefile
	--- a/multimedia/lms/Makefile
	+++ b/multimedia/lms/Makefile
	@@ -46,13 +46,6 @@
	MAGICK_LIB_DEPENDS= libGraphicsMagick.so:graphics/GraphicsMagick
	MAGICK_CMAKE_ON= -DLMS_IMAGE_BACKEND:STRING=graphicsmagick

	-.include <bsd.port.options.mk>
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
	-USES+= llvm:17 # fix the build failure on 13: error: object of type 'const lms::core::LiteralString' cannot be compared because its 'operator<=>' is implicitly deleted
	-.else
	-USES+= compiler:c++20-lang
	-.endif
	-
	post-patch:
	@${REINPLACE_CMD} -e 's\|"/etc"\|"${PREFIX}/etc"\|' \
	${WRKSRC}/src/libs/core/include/core/SystemPaths.hpp
	diff --git a/multimedia/oscam/Makefile b/multimedia/oscam/Makefile
	--- a/multimedia/oscam/Makefile
	+++ b/multimedia/oscam/Makefile
	@@ -26,12 +26,6 @@

	WRKSRC= ${WRKDIR}/${PORTNAME}-ef7f844

	-.include <bsd.port.pre.mk>
	-
	-.if ${ARCH:Mmips*}
	-USE_GCC= yes
	-.endif
	-
	do-install:
	${INSTALL_PROGRAM} ${WRKSRC}/Distribution/oscam ${STAGEDIR}${PREFIX}/bin/
	${INSTALL_MAN} ${WRKSRC}/Distribution/doc/man/*.1 ${STAGEDIR}${PREFIX}/share/man/man1/
	@@ -41,4 +35,4 @@
	${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/
	${INSTALL_DATA} ${WRKSRC}/Distribution/doc/example/* ${STAGEDIR}${EXAMPLESDIR}/

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/multimedia/tsduck/Makefile b/multimedia/tsduck/Makefile
	--- a/multimedia/tsduck/Makefile
	+++ b/multimedia/tsduck/Makefile
	@@ -11,8 +11,6 @@

	LICENSE= BSD2CLAUSE

	-BROKEN_FreeBSD_13= requires OpenSSL 3.0
	-
	BUILD_DEPENDS= bash:shells/bash \
	coreutils>0:sysutils/coreutils \
	dos2unix:converters/unix2dos \
	diff --git a/net-im/kaccounts-integration/Makefile b/net-im/kaccounts-integration/Makefile
	--- a/net-im/kaccounts-integration/Makefile
	+++ b/net-im/kaccounts-integration/Makefile
	@@ -18,10 +18,4 @@
	iconthemes:run
	USE_QT= base declarative

	-.include <bsd.port.options.mk>
	-
	-.if ${ARCH:Mpowerpc*} && ${OSVERSION} < 1400092
	-USES+= llvm:min=16
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/net-im/prosody/Makefile b/net-im/prosody/Makefile
	--- a/net-im/prosody/Makefile
	+++ b/net-im/prosody/Makefile
	@@ -61,10 +61,4 @@
	@${MKDIR} ${STAGEDIR}/var/run/prosody
	@${RM} ${STAGEDIR}${ETCDIR}/certs/*

	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000 && ${SSL_DEFAULT} == base
	-EXTRA_PATCHES= ${PATCHDIR}/freebsd-13-patches
	-.endif
	-
	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/net-im/prosody/files/freebsd-13-patches/patch-spec_util__crypto__spec.lua b/net-im/prosody/files/freebsd-13-patches/patch-spec_util__crypto__spec.lua
	deleted file mode 100644
	--- a/net-im/prosody/files/freebsd-13-patches/patch-spec_util__crypto__spec.lua
	+++ /dev/null
	@@ -1,35 +0,0 @@
	---- spec/util_crypto_spec.lua.orig 2025-03-13 13:12:42 UTC
	-+++ spec/util_crypto_spec.lua
	-@@ -3,32 +3,11 @@ describe("util.crypto", function ()
	- describe("util.crypto", function ()
	- local crypto = require "util.crypto";
	- local random = require "util.random";
	-- local encodings = require "util.encodings";
	-
	- describe("generate_ed25519_keypair", function ()
	- local keypair = crypto.generate_ed25519_keypair();
	- assert.is_not_nil(keypair);
	- assert.equal("ED25519", keypair:get_type());
	-- end)
	--
	-- describe("generate_p256_keypair", function ()
	-- local keypair = crypto.generate_p256_keypair();
	-- assert.is_not_nil(keypair);
	-- assert.equal("id-ecPublicKey", keypair:get_type());
	-- end)
	--
	-- describe("export/import raw", function ()
	-- local keypair = crypto.generate_p256_keypair();
	-- assert.is_not_nil(keypair);
	-- local raw = keypair:public_raw()
	-- local imported = crypto.import_public_ec_raw(raw, "P-256")
	-- assert.equal(keypair:public_pem(), imported:public_pem());
	-- end)
	--
	-- describe("derive", function ()
	-- local key = crypto.import_private_pem(test_keys.ecdsa_private_pem);
	-- local peer_key = crypto.import_public_pem(test_keys.ecdsa_public_pem);
	-- assert.equal("n1v4KeKmOVwjC67fiKtjJnqcEaasbpZa2fLPNHW51co=", encodings.base64.encode(key:derive(peer_key)))
	- end)
	-
	- describe("import_private_pem", function ()
	diff --git a/net-im/prosody/files/freebsd-13-patches/patch-util-src_crypto.c b/net-im/prosody/files/freebsd-13-patches/patch-util-src_crypto.c
	deleted file mode 100644
	--- a/net-im/prosody/files/freebsd-13-patches/patch-util-src_crypto.c
	+++ /dev/null
	@@ -1,171 +0,0 @@
	---- util-src/crypto.c.orig 2025-03-13 13:12:42 UTC
	-+++ util-src/crypto.c
	-@@ -27,7 +27,6 @@ typedef unsigned __int32 uint32_t;
	- #include <openssl/err.h>
	- #include <openssl/evp.h>
	- #include <openssl/obj_mac.h>
	--#include <openssl/param_build.h>
	- #include <openssl/pem.h>
	-
	- #if (LUA_VERSION_NUM == 501)
	-@@ -93,40 +92,6 @@ static int Lpkey_meth_get_type(lua_State *L) {
	- return 1;
	- }
	-
	--static int Lpkey_meth_derive(lua_State *L) {
	-- size_t outlen;
	-- EVP_PKEY *key = pkey_from_arg(L, 1, 0, 0);
	-- EVP_PKEY *peer = pkey_from_arg(L, 2, 0, 0);
	-- EVP_PKEY_CTX *ctx;
	-- BUF_MEM *buf;
	-- BIO *bio = new_managed_BIO_s_mem(L);
	-- BIO_get_mem_ptr(bio, &buf);
	-- if (!(ctx = EVP_PKEY_CTX_new(key, NULL)))
	-- goto sslerr;
	-- if (EVP_PKEY_derive_init(ctx) <= 0)
	-- goto sslerr;
	-- if (EVP_PKEY_derive_set_peer(ctx, peer) <= 0)
	-- goto sslerr;
	-- if (EVP_PKEY_derive(ctx, NULL, &outlen) <= 0)
	-- goto sslerr;
	-- if (!BUF_MEM_grow_clean(buf, outlen))
	-- goto sslerr;
	-- if (EVP_PKEY_derive(ctx, (unsigned char*)buf->data, &outlen) <= 0)
	-- goto sslerr;
	-- EVP_PKEY_CTX_free(ctx);
	-- ctx = NULL;
	-- lua_pushlstring(L, buf->data, outlen);
	-- BIO_reset(bio);
	-- return 1;
	--sslerr:
	-- if (ctx) {
	-- EVP_PKEY_CTX_free(ctx);
	-- ctx = NULL;
	-- }
	-- BIO_reset(bio);
	-- return luaL_error(L, "pkey:derive failed");
	--}
	--
	- static int base_evp_sign(lua_State L, const int key_type, const EVP_MD digest_type) {
	- EVP_PKEY *pkey = pkey_from_arg(L, 1, (key_type!=NID_rsassaPss)?key_type:NID_rsaEncryption, 1);
	- luaL_Buffer sigbuf;
	-@@ -198,28 +163,6 @@ cleanup:
	- return 1;
	- }
	-
	--static int Lpkey_meth_public_raw(lua_State *L) {
	-- OSSL_PARAM *params;
	-- EVP_PKEY *pkey = pkey_from_arg(L, 1, 0, 0);
	--
	-- if (EVP_PKEY_todata(pkey, EVP_PKEY_PUBLIC_KEY, &params)) {
	-- OSSL_PARAM *item = params;
	-- while (item->key) {
	-- if (!strcmp("pub", item->key)) {
	-- lua_pushlstring(L, item->data, item->data_size);
	-- break;
	-- }
	-- item++;
	-- }
	-- if (!item->key) lua_pushnil(L);
	-- OSSL_PARAM_free(params);
	-- } else {
	-- lua_pushnil(L);
	-- }
	--
	-- return 1;
	--}
	--
	- static int Lpkey_meth_public_pem(lua_State *L) {
	- char *data;
	- size_t bytes;
	-@@ -294,25 +237,6 @@ static int Lgenerate_ed25519_keypair(lua_State *L) {
	- return 1;
	- }
	-
	--static int Lgenerate_p256_keypair(lua_State *L) {
	-- EVP_PKEY *pkey = NULL;
	-- EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
	--
	-- /* Generate key */
	-- if (EVP_PKEY_keygen_init(pctx) <= 0) goto err;
	-- if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) goto err;
	-- if (EVP_PKEY_keygen(pctx, &pkey) <= 0) goto err;
	-- EVP_PKEY_CTX_free(pctx);
	--
	-- push_pkey(L, pkey, NID_X9_62_prime256v1, 1);
	-- return 1;
	--
	--err:
	-- if (pctx) EVP_PKEY_CTX_free(pctx);
	-- lua_pushnil(L);
	-- return 1;
	--}
	--
	- static int Limport_private_pem(lua_State *L) {
	- EVP_PKEY *pkey = NULL;
	-
	-@@ -333,42 +257,6 @@ static int Limport_private_pem(lua_State *L) {
	- return 1;
	- }
	-
	--static int Limport_public_ec_raw(lua_State *L) {
	-- OSSL_PARAM_BLD *param_bld = NULL;
	-- OSSL_PARAM *params = NULL;
	-- EVP_PKEY_CTX *ctx = NULL;
	-- EVP_PKEY *pkey = NULL;
	--
	-- size_t pubkey_bytes;
	-- const char* pubkey_data = luaL_checklstring(L, 1, &pubkey_bytes);
	-- const char* curve = luaL_checkstring(L, 2);
	--
	-- param_bld = OSSL_PARAM_BLD_new();
	-- if (!param_bld) goto err;
	-- if (!OSSL_PARAM_BLD_push_utf8_string(param_bld, "group", curve, 0)) goto err;
	-- if (!OSSL_PARAM_BLD_push_octet_string(param_bld, "pub", pubkey_data, pubkey_bytes)) goto err;
	-- params = OSSL_PARAM_BLD_to_param(param_bld);
	-- if (!params) goto err;
	-- ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
	-- if (!ctx) goto err;
	-- if (!EVP_PKEY_fromdata_init(ctx)) goto err;
	-- if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_PUBLIC_KEY, params) <= 0) goto err;
	--
	-- push_pkey(L, pkey, EVP_PKEY_id(pkey), 0);
	--
	-- EVP_PKEY_CTX_free(ctx);
	-- OSSL_PARAM_free(params);
	-- OSSL_PARAM_BLD_free(param_bld);
	--
	-- return 1;
	--err:
	-- if (ctx) EVP_PKEY_CTX_free(ctx);
	-- if (params) OSSL_PARAM_free(params);
	-- if (param_bld) OSSL_PARAM_BLD_free(param_bld);
	-- lua_pushnil(L);
	-- return 1;
	--}
	--
	- static int Limport_public_pem(lua_State *L) {
	- EVP_PKEY *pkey = NULL;
	-
	-@@ -683,11 +571,9 @@ static const luaL_Reg Reg[] = {
	- { "aes_256_ctr_decrypt", Laes_256_ctr_decrypt },
	-
	- { "generate_ed25519_keypair", Lgenerate_ed25519_keypair },
	-- { "generate_p256_keypair", Lgenerate_p256_keypair },
	-
	- { "import_private_pem", Limport_private_pem },
	- { "import_public_pem", Limport_public_pem },
	-- { "import_public_ec_raw", Limport_public_ec_raw },
	-
	- { "parse_ecdsa_signature", Lparse_ecdsa_signature },
	- { "build_ecdsa_signature", Lbuild_ecdsa_signature },
	-@@ -697,9 +583,7 @@ static const luaL_Reg KeyMethods[] = {
	- static const luaL_Reg KeyMethods[] = {
	- { "private_pem", Lpkey_meth_private_pem },
	- { "public_pem", Lpkey_meth_public_pem },
	-- { "public_raw", Lpkey_meth_public_raw },
	- { "get_type", Lpkey_meth_get_type },
	-- { "derive", Lpkey_meth_derive },
	- { NULL, NULL }
	- };
	-
	diff --git a/net-mgmt/andwatch/Makefile b/net-mgmt/andwatch/Makefile
	--- a/net-mgmt/andwatch/Makefile
	+++ b/net-mgmt/andwatch/Makefile
	@@ -9,8 +9,6 @@

	LICENSE= BSD2CLAUSE

	-BROKEN_FreeBSD_13= Does not build
	-
	LIB_DEPENDS= libsqlite3.so:databases/sqlite3 \
	libcurl.so:ftp/curl

	diff --git a/net-mgmt/ipfixcol2/Makefile b/net-mgmt/ipfixcol2/Makefile
	--- a/net-mgmt/ipfixcol2/Makefile
	+++ b/net-mgmt/ipfixcol2/Makefile
	@@ -34,12 +34,6 @@

	OPTIONS_DEFINE= EXAMPLES

	-# XXX Drop after FreeBSD 13 EOL around 2026-04-30
	-.if !exists(/usr/include/sys/timerfd.h)
	-CFLAGS+= `pkg-config --cflags epoll-shim`
	-LDFLAGS+= `pkg-config --libs epoll-shim`
	-.endif
	-
	post-install:
	${MKDIR} ${STAGEDIR}${ETCDIR} ${STAGEDIR}/var/run/${PORTNAME}
	${INSTALL_DATA} ${WRKSRC}/doc/data/configs/udp2json.xml \
	diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile
	--- a/net-mgmt/net-snmp/Makefile
	+++ b/net-mgmt/net-snmp/Makefile
	@@ -14,9 +14,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/COPYING

	-NOT_FOR_ARCHS= mips mips64
	-NOT_FOR_ARCHS_REASON= SSP is currently broken on MIPS
	-
	OPTIONS_DEFINE= MFD_REWRITES PERL PERL_EMBEDDED PYTHON DUMMY TKMIB \
	MYSQL AX_SOCKONLY UNPRIVILEGED SMUX DOCS AX_DISABLE_TRAP \
	TLS NEWSYSLOG NOLIBPKG SCTP AES
	diff --git a/net-mgmt/ocsinventory-agent/Makefile b/net-mgmt/ocsinventory-agent/Makefile
	--- a/net-mgmt/ocsinventory-agent/Makefile
	+++ b/net-mgmt/ocsinventory-agent/Makefile
	@@ -57,7 +57,7 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH} == aarch64 \|\| ${ARCH} == amd64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| ${ARCH} == riscv64 \|\| ${ARCH} == riscv64sf
	+.if ${ARCH} == aarch64 \|\| ${ARCH} == amd64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| ${ARCH} == riscv64
	RUN_DEPENDS+= dmidecode:sysutils/dmidecode
	.endif

	diff --git a/net-mgmt/p5-FusionInventory-Agent/Makefile b/net-mgmt/p5-FusionInventory-Agent/Makefile
	--- a/net-mgmt/p5-FusionInventory-Agent/Makefile
	+++ b/net-mgmt/p5-FusionInventory-Agent/Makefile
	@@ -50,7 +50,6 @@
	OPTIONS_DEFAULT_armv7= DMIDECODE
	OPTIONS_DEFAULT_i386= DMIDECODE
	OPTIONS_DEFAULT_riscv64= DMIDECODE
	-OPTIONS_DEFAULT_riscv64sf= DMIDECODE
	OPTIONS_SUB= yes

	DAEMON_DESC= Daemon mode, with opt. web interface
	diff --git a/net-p2p/hostd/Makefile b/net-p2p/hostd/Makefile
	--- a/net-p2p/hostd/Makefile
	+++ b/net-p2p/hostd/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= requires 64-bit architecture

	USES= go:1.24+,modules
	diff --git a/net-p2p/ncdc/Makefile b/net-p2p/ncdc/Makefile
	--- a/net-p2p/ncdc/Makefile
	+++ b/net-p2p/ncdc/Makefile
	@@ -26,10 +26,4 @@
	GEOIP_LIB_DEPENDS= libmaxminddb.so:net/libmaxminddb
	GEOIP_CONFIGURE_WITH= geoip

	-.include <bsd.port.options.mk>
	-
	-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
	-CONFIGURE_ENV= NCURSES_CFLAGS="-L${NCURSESLIB}" NCURSES_LIBS="-lncursesw"
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/net-p2p/qbittorrent/Makefile b/net-p2p/qbittorrent/Makefile
	--- a/net-p2p/qbittorrent/Makefile
	+++ b/net-p2p/qbittorrent/Makefile
	@@ -70,13 +70,6 @@

	.include <bsd.port.options.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
	-#LIB_DEPENDS+= libcrypto.so:security/openssl # LIB_DEPENDS doesn't work here (after bsd.port.options.mk)
	-BUILD_DEPENDS+= openssl>0:security/openssl
	-RUN_DEPENDS+= openssl>0:security/openssl
	-CMAKE_ARGS= -DOPENSSL_ROOT_DIR=${LOCALBASE}
	-.endif
	-
	post-patch-PYTHON-on:
	@${REINPLACE_CMD} \
	-e 's\|"python3"\|"${PYTHON_CMD}"\|' \
	diff --git a/net-p2p/renterd/Makefile b/net-p2p/renterd/Makefile
	--- a/net-p2p/renterd/Makefile
	+++ b/net-p2p/renterd/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= requires 64-bit architecture

	USES= go:1.24+,modules
	diff --git a/net-p2p/tremotesf/Makefile b/net-p2p/tremotesf/Makefile
	--- a/net-p2p/tremotesf/Makefile
	+++ b/net-p2p/tremotesf/Makefile
	@@ -14,6 +14,7 @@
	BUILD_DEPENDS= cxxopts>0:devel/cxxopts
	LIB_DEPENDS= libfmt.so:devel/libfmt \
	libpsl.so:dns/libpsl
	+TEST_DEPENDS= cpp-httplib>0:www/cpp-httplib

	USES= cmake:testing compiler:c++23-lang desktop-file-utils \
	gettext-tools gl kde:6 pkgconfig qt:6 tar:zst xorg
	@@ -23,16 +24,8 @@
	USE_QT= base
	USE_XORG= x11

	+CMAKE_ARGS= -DTREMOTESF_WITH_HTTPLIB=system
	EXTRACT_AFTER_ARGS= --exclude ${DISTNAME}/src/3rdparty/cpp-httplib \
	--no-same-owner --no-same-permissions

	-.include <bsd.port.options.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092
	-TEST_DEPENDS= cpp-httplib>0:www/cpp-httplib
	-CMAKE_ARGS= -DTREMOTESF_WITH_HTTPLIB=system
	-.else
	-CMAKE_ARGS= -DTREMOTESF_WITH_HTTPLIB=none
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/net-p2p/walletd/Makefile b/net-p2p/walletd/Makefile
	--- a/net-p2p/walletd/Makefile
	+++ b/net-p2p/walletd/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= requires 64-bit architecture

	USES= go:1.24+,modules
	diff --git a/net/aoe/Makefile b/net/aoe/Makefile
	--- a/net/aoe/Makefile
	+++ b/net/aoe/Makefile
	@@ -13,7 +13,6 @@

	BROKEN= aoenet.c:119:20: error: incomplete definition of type 'struct ifnet'
	BROKEN_armv6= fails to compile: implicit declaration of function 'cp15_pmccntr_get' is invalid in C99
	-BROKEN_FreeBSD_13= crashes dereferencing vnet_entry_ifnet
	BROKEN_FreeBSD_14= crashes dereferencing vnet_entry_ifnet

	USES= kmod uidfix
	diff --git a/net/asterisk20/Makefile b/net/asterisk20/Makefile
	--- a/net/asterisk20/Makefile
	+++ b/net/asterisk20/Makefile
	@@ -234,7 +234,7 @@
	EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-third-party_pjproject_Makefile
	.endif

	-.if (${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base) \|\| \
	+.if (${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base) \|\| \
	${SSL_DEFAULT:Mopenssl3*}
	LIB_DEPENDS+= libgnutls.so:security/gnutls
	CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
	diff --git a/net/asterisk22/Makefile b/net/asterisk22/Makefile
	--- a/net/asterisk22/Makefile
	+++ b/net/asterisk22/Makefile
	@@ -232,7 +232,7 @@
	EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-third-party_pjproject_Makefile
	.endif

	-.if (${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base) \|\| \
	+.if (${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base) \|\| \
	${SSL_DEFAULT:Mopenssl3*}
	LIB_DEPENDS+= libgnutls.so:security/gnutls
	CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
	diff --git a/net/bctoolbox/Makefile b/net/bctoolbox/Makefile
	--- a/net/bctoolbox/Makefile
	+++ b/net/bctoolbox/Makefile
	@@ -17,6 +17,9 @@
	GL_ACCOUNT= public
	USE_LDCONFIG= yes

	+IGNORE_SSL= openssl111
	+IGNORE_SSL_REASON= is not supported on systems with OpenSSL 1.1.1
	+
	CMAKE_ARGS= -DENABLE_STATIC=NO -DENABLE_STRICT=NO \
	-DCMAKE_PREFIX_PATH=${LOCALBASE} \
	-DCMAKE_SKIP_INSTALL_RPATH=ON \
	@@ -27,12 +30,6 @@
	CFLAGS+= -DHAVE_ARC4RANDOM
	LDFLAGS+= -lpthread

	-.include <bsd.port.options.mk>
	-
	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} < 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl111}
	-IGNORE= is not supported on systems with OpenSSL 1.1.1
	-.endif
	-
	post-patch:
	@${REINPLACE_CMD} '/clock_gettime/d' ${WRKSRC}/CMakeLists.txt

	diff --git a/net/bird2/Makefile b/net/bird2/Makefile
	--- a/net/bird2/Makefile
	+++ b/net/bird2/Makefile
	@@ -67,14 +67,4 @@
	CONFIGURE_ARGS+=--with-sysconfig=bsd-netlink
	.endif

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
	-FLAVORS= rtsock netlink
	-netlink_PKGNAMESUFFIX= 2-netlink
	-rtsock_PKGNAMESUFFIX= 2
	-.endif
	-
	-.if ${OPSYS} == FreeBSD && (${OSVERSION} >= 1500000 && ${OSVERSION} < 1500017)
	-EXTRA_PATCHES= ${PATCHDIR}/extra-patch-netlink-route
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h b/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h
	deleted file mode 100644
	--- a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h
	+++ /dev/null
	@@ -1,370 +0,0 @@
	---- /dev/null 2024-03-22 15:39:07.538356000 +0100
	-+++ sysdep/bsd-netlink/netlink-route.h 2024-03-22 15:39:02.226088000 +0100
	-@@ -0,0 +1,367 @@
	-+/*-
	-+ * SPDX-License-Identifier: BSD-2-Clause
	-+ *
	-+ * Copyright (c) 2022 Alexander V. Chernikov <melifaro@FreeBSD.org>
	-+ *
	-+ * Redistribution and use in source and binary forms, with or without
	-+ * modification, are permitted provided that the following conditions
	-+ * are met:
	-+ * 1. Redistributions of source code must retain the above copyright
	-+ * notice, this list of conditions and the following disclaimer.
	-+ * 2. Redistributions in binary form must reproduce the above copyright
	-+ * notice, this list of conditions and the following disclaimer in the
	-+ * documentation and/or other materials provided with the distribution.
	-+ *
	-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	-+ * SUCH DAMAGE.
	-+ */
	-+
	-+/*
	-+ * Route-related (RTM_<NEW\|DEL\|GET>ROUTE) message header and attributes.
	-+ */
	-+
	-+#ifndef _NETLINK_ROUTE_ROUTE_H_
	-+#define _NETLINK_ROUTE_ROUTE_H_
	-+
	-+/* Base header for all of the relevant messages */
	-+struct rtmsg {
	-+ unsigned char rtm_family; /* address family */
	-+ unsigned char rtm_dst_len; /* Prefix length */
	-+ unsigned char rtm_src_len; /* Source prefix length (not used) */
	-+ unsigned char rtm_tos; /* Type of service (not used) */
	-+ unsigned char rtm_table; /* rtable id */
	-+ unsigned char rtm_protocol; /* Routing protocol id (RTPROT_) */
	-+ unsigned char rtm_scope; /* Route distance (RT_SCOPE_) */
	-+ unsigned char rtm_type; /* Route type (RTN_) */
	-+ unsigned rtm_flags; /* Route flags (RTM_F_) */
	-+};
	-+
	-+/*
	-+ * RFC 3549, 3.1.1, route type (rtm_type field).
	-+ */
	-+enum {
	-+ RTN_UNSPEC,
	-+ RTN_UNICAST, /* Unicast route */
	-+ RTN_LOCAL, /* Accept locally (not supported) */
	-+ RTN_BROADCAST, /* Accept locally as broadcast, send as broadcast */
	-+ RTN_ANYCAST, /* Accept locally as broadcast, but send as unicast */
	-+ RTN_MULTICAST, /* Multicast route */
	-+ RTN_BLACKHOLE, /* Drop traffic towards destination */
	-+ RTN_UNREACHABLE, /* Destination is unreachable */
	-+ RTN_PROHIBIT, /* Administratively prohibited */
	-+ RTN_THROW, /* Not in this table (not supported) */
	-+ RTN_NAT, /* Translate this address (not supported) */
	-+ RTN_XRESOLVE, /* Use external resolver (not supported) */
	-+ __RTN_MAX,
	-+};
	-+#define RTN_MAX (__RTN_MAX - 1)
	-+
	-+/*
	-+ * RFC 3549, 3.1.1, protocol (Identifies what/who added the route).
	-+ * Values larger than RTPROT_STATIC(4) are not interpreted by the
	-+ * kernel, they are just for user information.
	-+ */
	-+#define RTPROT_UNSPEC 0
	-+#define RTPROT_REDIRECT 1 /* Route installed by ICMP redirect */
	-+#define RTPROT_KERNEL 2 /* Route installed by kernel */
	-+#define RTPROT_BOOT 3 /* Route installed during boot */
	-+#define RTPROT_STATIC 4 /* Route installed by administrator */
	-+
	-+#define RTPROT_GATED 8
	-+#define RTPROT_RA 9
	-+#define RTPROT_MRT 1
	-+#define RTPROT_ZEBRA 11
	-+#define RTPROT_BIRD 12
	-+#define RTPROT_DNROUTED 13
	-+#define RTPROT_XORP 14
	-+#define RTPROT_NTK 15
	-+#define RTPROT_DHCP 16
	-+#define RTPROT_MROUTED 17
	-+#define RTPROT_KEEPALIVED 18
	-+#define RTPROT_BABEL 42
	-+#define RTPROT_OPENR 99
	-+#define RTPROT_BGP 186
	-+#define RTPROT_ISIS 187
	-+#define RTPROT_OSPF 188
	-+#define RTPROT_RIP 189
	-+#define RTPROT_EIGRP 192
	-+
	-+/*
	-+ * RFC 3549 3.1.1 Route scope (valid distance to destination).
	-+ *
	-+ * The values between RT_SCOPE_UNIVERSE(0) and RT_SCOPE_SITE(200)
	-+ * are available to the user.
	-+ */
	-+enum rt_scope_t {
	-+ RT_SCOPE_UNIVERSE = 0,
	-+ /* User defined values */
	-+ RT_SCOPE_SITE = 200,
	-+ RT_SCOPE_LINK = 253,
	-+ RT_SCOPE_HOST = 254,
	-+ RT_SCOPE_NOWHERE = 255
	-+};
	-+
	-+/*
	-+ * RFC 3549 3.1.1 Route flags (rtm_flags).
	-+ * Is a composition of RTNH_F flags (0x1..0x40 range), RTM_F flags (below)
	-+ * and per-protocol (IPv4/IPv6) flags.
	-+ */
	-+#define RTM_F_NOTIFY 0x00000100 /* not supported */
	-+#define RTM_F_CLONED 0x00000200 /* not supported */
	-+#define RTM_F_EQUALIZE 0x00000400 /* not supported */
	-+#define RTM_F_PREFIX 0x00000800 /* not supported */
	-+#define RTM_F_LOOKUP_TABLE 0x00001000 /* not supported */
	-+#define RTM_F_FIB_MATCH 0x00002000 /* not supported */
	-+#define RTM_F_OFFLOAD 0x00004000 /* not supported */
	-+#define RTM_F_TRAP 0x00008000 /* not supported */
	-+#define RTM_F_OFFLOAD_FAILED 0x20000000 /* not supported */
	-+
	-+/* Compatibility handling helpers */
	-+#ifndef _KERNEL
	-+#define NL_RTM_HDRLEN ((int)sizeof(struct rtmsg))
	-+#define RTM_RTA(_rtm) ((struct rtattr )((char )(_rtm) + NL_RTM_HDRLEN))
	-+#define RTM_PAYLOAD(_hdr) NLMSG_PAYLOAD((_hdr), NL_RTM_HDRLEN)
	-+#endif
	-+
	-+/*
	-+ * Routing table identifiers.
	-+ * FreeBSD route table numbering starts from 0, where 0 is a valid default routing table.
	-+ * Indicating "all tables" via netlink can be done by not including RTA_TABLE attribute
	-+ * and keeping rtm_table=0 (compatibility) or setting RTA_TABLE value to RT_TABLE_UNSPEC.
	-+ */
	-+#define RT_TABLE_MAIN 0 /* RT_DEFAULT_FIB */
	-+#define RT_TABLE_UNSPEC 0xFFFFFFFF /* RT_ALL_FIBS */
	-+
	-+enum rtattr_type_t {
	-+ NL_RTA_UNSPEC,
	-+ NL_RTA_DST = 1, /* binary, IPv4/IPv6 destination */
	-+ NL_RTA_SRC = 2, /* binary, preferred source address */
	-+ NL_RTA_IIF = 3, /* not supported */
	-+ NL_RTA_OIF = 4, /* u32, transmit ifindex */
	-+ NL_RTA_GATEWAY = 5, /* binary: IPv4/IPv6 gateway */
	-+ NL_RTA_PRIORITY = 6, /* not supported */
	-+ NL_RTA_PREFSRC = 7, /* not supported */
	-+ NL_RTA_METRICS = 8, /* nested, list of NL_RTAX* attrs */
	-+ NL_RTA_MULTIPATH = 9, /* binary, array of struct rtnexthop */
	-+ NL_RTA_PROTOINFO = 10, /* not supported / deprecated */
	-+ NL_RTA_KNH_ID = 10, /* u32, FreeBSD specific, kernel nexthop index */
	-+ NL_RTA_FLOW = 11, /* not supported */
	-+ NL_RTA_CACHEINFO = 12, /* not supported */
	-+ NL_RTA_SESSION = 13, /* not supported / deprecated */
	-+ NL_RTA_WEIGHT = 13, /* u32, FreeBSD specific, path weight */
	-+ NL_RTA_MP_ALGO = 14, /* not supported / deprecated */
	-+ NL_RTA_RTFLAGS = 14, /* u32, FreeBSD specific, path flags (RTF_)*/
	-+ NL_RTA_TABLE = 15, /* u32, fibnum */
	-+ NL_RTA_MARK = 16, /* not supported */
	-+ NL_RTA_MFC_STATS = 17, /* not supported */
	-+ NL_RTA_VIA = 18, /* binary, struct rtvia */
	-+ NL_RTA_NEWDST = 19, /* not supported */
	-+ NL_RTA_PREF = 20, /* not supported */
	-+ NL_RTA_ENCAP_TYPE = 21, /* not supported */
	-+ NL_RTA_ENCAP = 22, /* not supported */
	-+ NL_RTA_EXPIRES = 23, /* u32, seconds till expiration */
	-+ NL_RTA_PAD = 24, /* not supported */
	-+ NL_RTA_UID = 25, /* not supported */
	-+ NL_RTA_TTL_PROPAGATE = 26, /* not supported */
	-+ NL_RTA_IP_PROTO = 27, /* not supported */
	-+ NL_RTA_SPORT = 28, /* not supported */
	-+ NL_RTA_DPORT = 29, /* not supported */
	-+ NL_RTA_NH_ID = 30, /* u32, nexthop/nexthop group index */
	-+ __RTA_MAX
	-+};
	-+#define NL_RTA_MAX (__RTA_MAX - 1)
	-+
	-+/*
	-+ * Attributes that can be used as filters:
	-+ *
	-+ */
	-+
	-+#ifndef _KERNEL
	-+/*
	-+ * RTA_* space has clashes with rtsock namespace.
	-+ * Use NL_RTA_ prefix in the kernel and map to
	-+ * RTA_ for userland.
	-+ */
	-+#define RTA_UNSPEC NL_RTA_UNSPEC
	-+#define RTA_DST NL_RTA_DST
	-+#define RTA_SRC NL_RTA_SRC
	-+#define RTA_IIF NL_RTA_IIF
	-+#define RTA_OIF NL_RTA_OIF
	-+#define RTA_GATEWAY NL_RTA_GATEWAY
	-+#define RTA_PRIORITY NL_RTA_PRIORITY
	-+#define RTA_PREFSRC NL_RTA_PREFSRC
	-+#define RTA_METRICS NL_RTA_METRICS
	-+#define RTA_MULTIPATH NL_RTA_MULTIPATH
	-+#define RTA_PROTOINFO NL_RTA_PROTOINFO
	-+#define RTA_KNH_ID NL_RTA_KNH_ID
	-+#define RTA_FLOW NL_RTA_FLOW
	-+#define RTA_CACHEINFO NL_RTA_CACHEINFO
	-+#define RTA_SESSION NL_RTA_SESSION
	-+#define RTA_MP_ALGO NL_RTA_MP_ALGO
	-+#define RTA_TABLE NL_RTA_TABLE
	-+#define RTA_MARK NL_RTA_MARK
	-+#define RTA_MFC_STATS NL_RTA_MFC_STATS
	-+#define RTA_VIA NL_RTA_VIA
	-+#define RTA_NEWDST NL_RTA_NEWDST
	-+#define RTA_PREF NL_RTA_PREF
	-+#define RTA_ENCAP_TYPE NL_RTA_ENCAP_TYPE
	-+#define RTA_ENCAP NL_RTA_ENCAP
	-+#define RTA_EXPIRES NL_RTA_EXPIRES
	-+#define RTA_PAD NL_RTA_PAD
	-+#define RTA_UID NL_RTA_UID
	-+#define RTA_TTL_PROPAGATE NL_RTA_TTL_PROPAGATE
	-+#define RTA_IP_PROTO NL_RTA_IP_PROTO
	-+#define RTA_SPORT NL_RTA_SPORT
	-+#define RTA_DPORT NL_RTA_DPORT
	-+#define RTA_NH_ID NL_RTA_NH_ID
	-+#define RTA_MAX NL_RTA_MAX
	-+#endif
	-+
	-+/* route attribute header */
	-+struct rtattr {
	-+ unsigned short rta_len;
	-+ unsigned short rta_type;
	-+};
	-+
	-+#define NL_RTA_ALIGN_SIZE NL_ITEM_ALIGN_SIZE
	-+#define NL_RTA_ALIGN NL_ITEM_ALIGN
	-+#define NL_RTA_HDRLEN ((int)sizeof(struct rtattr))
	-+#define NL_RTA_DATA_LEN(_rta) ((int)((_rta)->rta_len - NL_RTA_HDRLEN))
	-+#define NL_RTA_DATA(_rta) NL_ITEM_DATA(_rta, NL_RTA_HDRLEN)
	-+#define NL_RTA_DATA_CONST(_rta) NL_ITEM_DATA_CONST(_rta, NL_RTA_HDRLEN)
	-+
	-+/* Compatibility attribute handling helpers */
	-+#ifndef _KERNEL
	-+#define RTA_ALIGNTO NL_RTA_ALIGN_SIZE
	-+#define RTA_ALIGN(_len) NL_RTA_ALIGN(_len)
	-+#define _RTA_LEN(_rta) ((int)(_rta)->rta_len)
	-+#define _RTA_ALIGNED_LEN(_rta) RTA_ALIGN(_RTA_LEN(_rta))
	-+#define RTA_OK(_rta, _len) NL_ITEM_OK(_rta, _len, NL_RTA_HDRLEN, _RTA_LEN)
	-+#define RTA_NEXT(_rta, _len) NL_ITEM_ITER(_rta, _len, _RTA_ALIGNED_LEN)
	-+#define RTA_LENGTH(_len) (NL_RTA_HDRLEN + (_len))
	-+#define RTA_SPACE(_len) RTA_ALIGN(RTA_LENGTH(_len))
	-+#define RTA_DATA(_rta) NL_RTA_DATA(_rta)
	-+#define RTA_PAYLOAD(_rta) ((int)(_RTA_LEN(_rta) - NL_RTA_HDRLEN))
	-+#endif
	-+
	-+/* RTA attribute headers */
	-+
	-+/* RTA_VIA */
	-+struct rtvia {
	-+ sa_family_t rtvia_family;
	-+ uint8_t rtvia_addr[0];
	-+};
	-+
	-+/*
	-+ * RTA_METRICS is a nested attribute, consisting of a list of
	-+ * TLVs with types defined below.
	-+ */
	-+ enum {
	-+ NL_RTAX_UNSPEC,
	-+ NL_RTAX_LOCK = 1, /* not supported */
	-+ NL_RTAX_MTU = 2, /* desired path MTU */
	-+ NL_RTAX_WINDOW = 3, /* not supported */
	-+ NL_RTAX_RTT = 4, /* not supported */
	-+ NL_RTAX_RTTVAR = 5, /* not supported */
	-+ NL_RTAX_SSTHRESH = 6, /* not supported */
	-+ NL_RTAX_CWND = 7, /* not supported */
	-+ NL_RTAX_ADVMSS = 8, /* not supported */
	-+ NL_RTAX_REORDERING = 9, /* not supported */
	-+ NL_RTAX_HOPLIMIT = 10, /* not supported */
	-+ NL_RTAX_INITCWND = 11, /* not supporrted */
	-+ NL_RTAX_FEATURES = 12, /* not supported */
	-+ NL_RTAX_RTO_MIN = 13, /* not supported */
	-+ NL_RTAX_INITRWND = 14, /* not supported */
	-+ NL_RTAX_QUICKACK = 15, /* not supported */
	-+ NL_RTAX_CC_ALGO = 16, /* not supported */
	-+ NL_RTAX_FASTOPEN_NO_COOKIE = 17, /* not supported */
	-+ __NL_RTAX_MAX
	-+};
	-+#define NL_RTAX_MAX (__NL_RTAX_MAX - 1)
	-+
	-+#define RTAX_FEATURE_ECN (1 << 0)
	-+#define RTAX_FEATURE_SACK (1 << 1)
	-+#define RTAX_FEATURE_TIMESTAMP (1 << 2)
	-+#define RTAX_FEATURE_ALLFRAG (1 << 3)
	-+
	-+#define RTAX_FEATURE_MASK \
	-+ (RTAX_FEATURE_ECN \| RTAX_FEATURE_SACK \| RTAX_FEATURE_TIMESTAMP \| \
	-+ RTAX_FEATURE_ALLFRAG)
	-+
	-+#ifndef _KERNEL
	-+
	-+/*
	-+ * RTAX_* space clashes with rtsock namespace.
	-+ * Use NL_RTAX_ prefix in the kernel and map to
	-+ * RTAX_ for userland.
	-+ */
	-+#define RTAX_UNSPEC NL_RTAX_UNSPEC
	-+#define RTAX_LOCK NL_RTAX_LOCK
	-+#define RTAX_MTU NL_RTAX_MTU
	-+#define RTAX_WINDOW NL_RTAX_WINDOW
	-+#define RTAX_RTT NL_RTAX_RTT
	-+#define RTAX_RTTVAR NL_RTAX_RTTVAR
	-+#define RTAX_SSTHRESH NL_RTAX_SSTHRESH
	-+#define RTAX_CWND NL_RTAX_CWND
	-+#define RTAX_ADVMSS NL_RTAX_ADVMSS
	-+#define RTAX_REORDERING NL_RTAX_REORDERING
	-+#define RTAX_HOPLIMIT NL_RTAX_HOPLIMIT
	-+#define RTAX_INITCWND NL_RTAX_INITCWND
	-+#define RTAX_FEATURES NL_RTAX_FEATURES
	-+#define RTAX_RTO_MIN NL_RTAX_RTO_MIN
	-+#define RTAX_INITRWND NL_RTAX_INITRWND
	-+#define RTAX_QUICKACK NL_RTAX_QUICKACK
	-+#define RTAX_CC_ALGO NL_RTAX_CC_ALGO
	-+#define RTAX_FASTOPEN_NO_COOKIE NL_RTAX_FASTOPEN_NO_COOKIE
	-+#endif
	-+
	-+/*
	-+ * RTA_MULTIPATH consists of an array of rtnexthop structures.
	-+ * Each rtnexthop structure contains RTA_GATEWAY or RTA_VIA
	-+ * attribute following the header.
	-+ */
	-+struct rtnexthop {
	-+ unsigned short rtnh_len;
	-+ unsigned char rtnh_flags;
	-+ unsigned char rtnh_hops; /* nexthop weight */
	-+ int rtnh_ifindex;
	-+};
	-+
	-+/* rtnh_flags */
	-+#define RTNH_F_DEAD 0x01 /* not supported */
	-+#define RTNH_F_PERVASIVE 0x02 /* not supported */
	-+#define RTNH_F_ONLINK 0x04 /* not supported */
	-+#define RTNH_F_OFFLOAD 0x08 /* not supported */
	-+#define RTNH_F_LINKDOWN 0x10 /* not supported */
	-+#define RTNH_F_UNRESOLVED 0x20 /* not supported */
	-+#define RTNH_F_TRAP 0x40 /* not supported */
	-+
	-+#define RTNH_COMPARE_MASK (RTNH_F_DEAD \| RTNH_F_LINKDOWN \| \
	-+ RTNH_F_OFFLOAD \| RTNH_F_TRAP)
	-+
	-+/* Macros to handle hexthops */
	-+#define RTNH_ALIGNTO NL_ITEM_ALIGN_SIZE
	-+#define RTNH_ALIGN(_len) NL_ITEM_ALIGN(_len)
	-+#define RTNH_HDRLEN ((int)sizeof(struct rtnexthop))
	-+#define _RTNH_LEN(_nh) ((int)(_nh)->rtnh_len)
	-+#define _RTNH_ALIGNED_LEN(_nh) RTNH_ALIGN(_RTNH_LEN(_nh))
	-+#define RTNH_OK(_nh, _len) NL_ITEM_OK(_nh, _len, RTNH_HDRLEN, _RTNH_LEN)
	-+#define RTNH_NEXT(_nh) ((struct rtnexthop )((char )(_nh) + _RTNH_ALIGNED_LEN(_nh)))
	-+#define RTNH_LENGTH(_len) (RTNH_HDRLEN + (_len))
	-+#define RTNH_SPACE(_len) RTNH_ALIGN(RTNH_LENGTH(_len))
	-+#define RTNH_DATA(_nh) ((struct rtattr *)NL_ITEM_DATA(_nh, RTNH_HDRLEN))
	-+
	-+struct rtgenmsg {
	-+ unsigned char rtgen_family;
	-+};
	-+
	-+#endif
	diff --git a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h b/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h
	deleted file mode 100644
	--- a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h
	+++ /dev/null
	@@ -1,10 +0,0 @@
	---- sysdep/bsd-netlink/netlink-sys.h.orig 2024-03-22 14:19:18 UTC
	-+++ sysdep/bsd-netlink/netlink-sys.h
	-@@ -9,6 +9,7 @@
	- #ifndef _BIRD_NETLINK_SYS_H_
	- #define _BIRD_NETLINK_SYS_H_
	-
	-+#include "netlink-route.h"
	- #include <netlink/netlink.h>
	- #include <netlink/netlink_route.h>
	-
	diff --git a/net/cloud-init/Makefile b/net/cloud-init/Makefile
	--- a/net/cloud-init/Makefile
	+++ b/net/cloud-init/Makefile
	@@ -46,7 +46,7 @@

	.include <bsd.port.options.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400000
	+.if ${OPSYS} == FreeBSD
	EXTRA_PATCHES+= ${PATCHDIR}/extra-cloudinit_distros_freebsd.py
	.endif

	diff --git a/net/delegate/Makefile b/net/delegate/Makefile
	--- a/net/delegate/Makefile
	+++ b/net/delegate/Makefile
	@@ -15,9 +15,6 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE.txt
	LICENSE_PERMS= dist-mirror pkg-mirror auto-accept

	-BROKEN_mips= fails to build: gmake[1]: [Makefile:116: mkmake.exe] Error 1
	-BROKEN_mips64= fails to build: gmake[1]: [Makefile:116: mkmake.exe] Error 1
	-
	USES= compiler:c11 cpe gmake
	SUB_FILES= pkg-message

	diff --git a/net/eternalterminal/Makefile b/net/eternalterminal/Makefile
	--- a/net/eternalterminal/Makefile
	+++ b/net/eternalterminal/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= OpenSSL versions prior to 3.0.0 are not supported
	-
	LIB_DEPENDS= libabsl_log_internal_check_op.so:devel/abseil \
	libprotobuf.so:devel/protobuf \
	libsodium.so:security/libsodium \
	diff --git a/net/gotify-server/Makefile b/net/gotify-server/Makefile
	--- a/net/gotify-server/Makefile
	+++ b/net/gotify-server/Makefile
	@@ -16,7 +16,7 @@
	BROKEN_i386= Build does not succeed (timeout in poudriere)

	BUILD_DEPENDS= yarn${NODEJS_SUFFIX}>=1.10.0:www/yarn${NODEJS_SUFFIX} \
	-
	+
	USES= go:modules nodejs:build
	USE_RC_SUBR= gotify_server
	GO_MODULE= github.com/gotify/server/v2
	@@ -30,7 +30,7 @@
	-X 'main.BuildDate=${_BUILD_DATE}' \
	-X 'main.Mode=prod'"

	-.include <bsd.port.pre.mk>
	+MAKE_ENV+= NODE_OPTIONS=--openssl-legacy-provider

	USERS= gotify
	GROUPS= gotify
	@@ -40,7 +40,7 @@
	post-patch:
	# setup yarnrc for offline node_modules installatio
	@${ECHO_CMD} 'yarn-offline-mirror "${WRKDIR}/yarn-offline-cache"' >> ${WRKSRC}/ui/.yarnrc
	-
	+
	pre-build:
	@cd ${WRKSRC}/ui && ${SETENV} ${MAKE_ENV} HOME=${WRKDIR} PUPPETEER_SKIP_DOWNLOAD=true yarn install --offline
	@cd ${WRKSRC}/ui && ${SETENV} ${MAKE_ENV} yarn build
	@@ -80,4 +80,4 @@
	@${ECHO_CMD} upload ${PORTNAME}-yarn-offline-cache-${DISTVERSION}${EXTRACT_SUFX}
	#@${ECHO_CMD} scp work/gotify-server-yarn-offline-cache-*.tar.gz mfechner@freefall.freebsd.org:public_distfiles/

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/net/hsflowd/Makefile b/net/hsflowd/Makefile
	--- a/net/hsflowd/Makefile
	+++ b/net/hsflowd/Makefile
	@@ -7,9 +7,6 @@
	COMMENT= Agent that exports metrics using the sFlow protocol
	WWW= https://host-sflow.sourceforge.net/

	-BROKEN_mips= fails to compile: src/FreeBSD/Makefile: Malformed conditional (empty $(BINDIR))
	-BROKEN_mips64= fails to compile: src/FreeBSD/Makefile: Malformed conditional (empty $(BINDIR))
	-
	SUB_FILES= pkg-message
	USE_RC_SUBR= ${PORTNAME}
	MAKE_ENV= BINDIR=${PREFIX}/sbin INITDIR=${PREFIX}/etc/rc.d \
	diff --git a/net/kdenetwork-filesharing/Makefile b/net/kdenetwork-filesharing/Makefile
	--- a/net/kdenetwork-filesharing/Makefile
	+++ b/net/kdenetwork-filesharing/Makefile
	@@ -16,11 +16,4 @@

	OPTIONS_DEFINE= DOCS

	-.include <bsd.port.options.mk>
	-
	-.if ${ARCH:Mpowerpc*} && ${OSVERSION} < 1400092
	-CXX= clang++${LLVM_VERSION}
	-USES+= llvm:min=16
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/net/librdkafka/Makefile b/net/librdkafka/Makefile
	--- a/net/librdkafka/Makefile
	+++ b/net/librdkafka/Makefile
	@@ -10,9 +10,6 @@
	LICENSE= BSD2CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_mips= fails to build: undefined reference to __sync_add_and_fetch_4
	-BROKEN_mips64= fails to build: undefined reference to __sync_add_and_fetch_4
	-
	BUILD_DEPENDS= bash:shells/bash \
	${LOCALBASE}/include/rapidjson/schema.h:devel/rapidjson
	LIB_DEPENDS= libcurl.so:ftp/curl \
	diff --git a/net/libusrsctp/Makefile b/net/libusrsctp/Makefile
	--- a/net/libusrsctp/Makefile
	+++ b/net/libusrsctp/Makefile
	@@ -26,11 +26,8 @@

	CFLAGS+= -Wno-error

	-.include <bsd.port.pre.mk>
	-
	post-patch:
	-.if ${OSVERSION} >= 1400000
	@${REINPLACE_CMD} -e 's\|ip6protosw.h\|ip6_var.h\|g' \
	${WRKSRC}/usrsctplib/netinet/sctp_os_userspace.h
	-.endif
	-.include <bsd.port.post.mk>
	+
	+.include <bsd.port.mk>
	diff --git a/net/messagelib/Makefile b/net/messagelib/Makefile
	--- a/net/messagelib/Makefile
	+++ b/net/messagelib/Makefile
	@@ -8,8 +8,6 @@

	LICENSE= LGPL21

	-IGNORE_FreeBSD_13= is not supported on systems with OpenSSL 1.1.1
	-
	BUILD_DEPENDS= ${LOCALBASE}/include/boost/range/algorithm.hpp:devel/boost-libs
	LIB_DEPENDS= libassuan.so:security/libassuan \
	libgpg-error.so:security/libgpg-error \
	diff --git a/net/openmpi/Makefile b/net/openmpi/Makefile
	--- a/net/openmpi/Makefile
	+++ b/net/openmpi/Makefile
	@@ -61,8 +61,6 @@
	OPTIONS_EXCLUDE_armv6= AVX SLURM
	OPTIONS_EXCLUDE_armv7= AVX SLURM
	OPTIONS_EXCLUDE_i386= SLURM
	-OPTIONS_EXCLUDE_mips= AVX SLURM
	-OPTIONS_EXCLUDE_mips64= AVX
	OPTIONS_EXCLUDE_powerpc= AVX SLURM
	OPTIONS_EXCLUDE_powerpc64= AVX
	OPTIONS_EXCLUDE_powerpc64le= AVX
	diff --git a/net/openmpi4/Makefile b/net/openmpi4/Makefile
	--- a/net/openmpi4/Makefile
	+++ b/net/openmpi4/Makefile
	@@ -60,8 +60,6 @@
	OPTIONS_EXCLUDE_armv6= AVX SLURM
	OPTIONS_EXCLUDE_armv7= AVX SLURM
	OPTIONS_EXCLUDE_i386= SLURM
	-OPTIONS_EXCLUDE_mips= AVX SLURM
	-OPTIONS_EXCLUDE_mips64= AVX
	OPTIONS_EXCLUDE_powerpc= AVX SLURM
	OPTIONS_EXCLUDE_powerpc64= AVX
	OPTIONS_EXCLUDE_powerpc64le= AVX
	diff --git a/net/openvswitch/Makefile b/net/openvswitch/Makefile
	--- a/net/openvswitch/Makefile
	+++ b/net/openvswitch/Makefile
	@@ -9,8 +9,6 @@

	LICENSE= APACHE20

	-BROKEN_mips64= fails to compile: ofp-actions.h:486: flexible array member in otherwise empty struct
	-
	BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}

	USES= compiler:c11 cpe gmake libtool perl5 pkgconfig python \
	diff --git a/net/p5-Net-AMQP-RabbitMQ/Makefile b/net/p5-Net-AMQP-RabbitMQ/Makefile
	--- a/net/p5-Net-AMQP-RabbitMQ/Makefile
	+++ b/net/p5-Net-AMQP-RabbitMQ/Makefile
	@@ -13,9 +13,6 @@
	LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT
	LICENSE_FILE_MPL11= ${WRKSRC}/LICENSE-MPL-1.1

	-NOT_FOR_ARCHS= mips mips64
	-NOT_FOR_ARCHS_REASON= Endianness not known
	-
	BUILD_DEPENDS= p5-Devel-CheckLib>=0:devel/p5-Devel-CheckLib \
	${RUN_DEPENDS}
	RUN_DEPENDS= p5-Math-Int64>0.34:math/p5-Math-Int64
	diff --git a/net/pvm/Makefile b/net/pvm/Makefile
	--- a/net/pvm/Makefile
	+++ b/net/pvm/Makefile
	@@ -11,8 +11,6 @@

	LICENSE= MIT

	-BROKEN_mips= fails to compile: 'SIGCLD' undeclared (first use in this function)
	-BROKEN_mips64= fails to compile: 'SIGCLD' undeclared (first use in this function)
	BROKEN_riscv64= fails to build: grep: pvm3/conf/UNKNOWN.def: No such file or directory

	USES= tar:tgz
	diff --git a/net/realtek-rge-kmod/Makefile b/net/realtek-rge-kmod/Makefile
	--- a/net/realtek-rge-kmod/Makefile
	+++ b/net/realtek-rge-kmod/Makefile
	@@ -11,8 +11,6 @@

	LICENSE= BSD2CLAUSE

	-IGNORE_FreeBSD_13= Does not build on FreeBSD <=13
	-
	USES= kmod tar:tgz uidfix

	USE_GITHUB= yes
	diff --git a/net/relayd/files/patch-share_mk_bsd.own.mk b/net/relayd/files/patch-share_mk_bsd.own.mk
	--- a/net/relayd/files/patch-share_mk_bsd.own.mk
	+++ b/net/relayd/files/patch-share_mk_bsd.own.mk
	@@ -5,7 +5,7 @@
	CLANG_ARCH=aarch64 amd64 arm i386 mips64 mips64el powerpc powerpc64 riscv64 sparc64
	# BEGIN FreeBSD-relayd
	-CLANG_ARCH=aarch64 amd64 arm armv6 armv7 i386 mips64 mips64el powerpc powerpc64 riscv64 sparc64
	-+CLANG_ARCH=aarch64 amd64 arm armv6 armv7 i386 mips64 mips64el powerpc powerpc64 powerpc64le riscv64
	++CLANG_ARCH=aarch64 amd64 arm armv6 armv7 i386 powerpc powerpc64 powerpc64le riscv64
	# END FreeBSD-relayd
	GCC4_ARCH=alpha hppa sh sparc64
	GCC3_ARCH=m88k
	diff --git a/net/samba416/Makefile b/net/samba416/Makefile
	--- a/net/samba416/Makefile
	+++ b/net/samba416/Makefile
	@@ -536,7 +536,7 @@
	.endif

	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} \|\| ${PORT_OPTIONS:MDEVELOPER})
	# LMDB
	SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
	diff --git a/net/samba419/Makefile b/net/samba419/Makefile
	--- a/net/samba419/Makefile
	+++ b/net/samba419/Makefile
	@@ -524,7 +524,7 @@
	.include <bsd.port.pre.mk>
	##############################################################################
	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} \|\| ${PORT_OPTIONS:MDEVELOPER})
	# LMDB
	SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
	diff --git a/net/samba420/Makefile b/net/samba420/Makefile
	--- a/net/samba420/Makefile
	+++ b/net/samba420/Makefile
	@@ -524,7 +524,7 @@
	.include <bsd.port.pre.mk>
	##############################################################################
	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} \|\| ${PORT_OPTIONS:MDEVELOPER})
	# LMDB
	SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
	diff --git a/net/samba422/Makefile b/net/samba422/Makefile
	--- a/net/samba422/Makefile
	+++ b/net/samba422/Makefile
	@@ -435,7 +435,7 @@
	.endif

	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	. if (${PORT_OPTIONS:MAD_DC} \|\| ${PORT_OPTIONS:MDEVELOPER})
	# LMDB
	_LMDB_DEPDENDS= lmdb>=0.9.16:databases/lmdb
	diff --git a/net/samba423/Makefile b/net/samba423/Makefile
	--- a/net/samba423/Makefile
	+++ b/net/samba423/Makefile
	@@ -427,7 +427,7 @@
	.endif

	# Only for 64-bit architectures
	-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
	. if (${PORT_OPTIONS:MAD_DC} \|\| ${PORT_OPTIONS:MDEVELOPER})
	# LMDB
	_LMDB_DEPDENDS= lmdb>=0.9.16:databases/lmdb
	diff --git a/net/tcplog_dumper/Makefile b/net/tcplog_dumper/Makefile
	--- a/net/tcplog_dumper/Makefile
	+++ b/net/tcplog_dumper/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= BSD2CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-ONLY_FOR_ARCHS= aarch64 amd64 mips64 mips64el mips64elhf mips64hf powerpc64 powerpc64le riscv64 riscv64sf
	+ONLY_FOR_ARCHS= aarch64 amd64 powerpc64 powerpc64le riscv64
	ONLY_FOR_ARCHS_REASON= only 64-bit platforms are supported

	USE_GITHUB= yes
	diff --git a/net/vpp/Makefile b/net/vpp/Makefile
	--- a/net/vpp/Makefile
	+++ b/net/vpp/Makefile
	@@ -16,8 +16,6 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-IGNORE_FreeBSD_13= is not supported on FreeBSD 13.x due to missing timerfd library shim
	-
	BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}ply>0:devel/py-ply@${PY_FLAVOR} \
	bash:shells/bash \
	cmake:devel/cmake-core
	diff --git a/net/wifi-firmware-kmod/Makefile.inc b/net/wifi-firmware-kmod/Makefile.inc
	--- a/net/wifi-firmware-kmod/Makefile.inc
	+++ b/net/wifi-firmware-kmod/Makefile.inc
	@@ -91,13 +91,6 @@
	# allows direct loading of firmware files.
	# We write a PLIST file so we can then simply use COPYTREE_SHARE with adjusted
	# permissions to copy the files over.
	-.if (${OSVERSION} < 1402000) \|\| (${OSVERSION} >= 1500000 && ${OSVERSION} < 1500014)
	-# For 13.5, which is the last supported release before plain firmware loading is
	-# implemented, we did ship firmware in src/ still so there is no need to build.
	-# Also mtw (mt7601u) was never in a version earlier than this.
	-# XXX remove comment after April 2026 when 13.5 goes out of support as well.
	-IGNORE= Not supported for this osversion.
	-.endif

	BOOT_LOADERCONFD= /boot/loader.conf.d
	BOOTFWDIR?= /boot/firmware
	diff --git a/net/wifibox-core/Makefile b/net/wifibox-core/Makefile
	--- a/net/wifibox-core/Makefile
	+++ b/net/wifibox-core/Makefile
	@@ -36,13 +36,7 @@
	MAKE_ARGS+= GUEST_ROOT=${LOCALBASE}/share/wifibox \
	GUEST_MAN=${LOCALBASE}/share/man/man5/wifibox-alpine.5.gz \
	VERSION=${PORTVERSION} \
	- RECOVERY_METHOD=${PORT_OPTIONS:MRECOVER_*:S/RECOVER_//:tl}
	-
	-.if ${OSVERSION} > 1400089
	-MAKE_ARGS+= DEVD_FIX=
	-PLIST_SUB+= DEVD_FIX="@comment "
	-.else
	-PLIST_SUB+= DEVD_FIX=""
	-.endif
	+ RECOVERY_METHOD=${PORT_OPTIONS:MRECOVER_*:S/RECOVER_//:tl} \
	+ DEVD_FIX=

	.include <bsd.port.mk>
	diff --git a/net/wifibox-core/pkg-plist b/net/wifibox-core/pkg-plist
	--- a/net/wifibox-core/pkg-plist
	+++ b/net/wifibox-core/pkg-plist
	@@ -1,6 +1,5 @@
	@sample etc/wifibox/bhyve.conf.sample
	@sample etc/wifibox/core.conf.sample
	-%%DEVD_FIX%%@sample etc/devd/wifibox.conf.sample
	etc/rc.d/wifibox
	sbin/wifibox
	share/man/man5/wifibox-guest.5.gz
	diff --git a/ports-mgmt/Makefile b/ports-mgmt/Makefile
	--- a/ports-mgmt/Makefile
	+++ b/ports-mgmt/Makefile
	@@ -61,7 +61,6 @@
	SUBDIR += portsearch
	SUBDIR += portshaker
	SUBDIR += portshaker-config
	- SUBDIR += portsnap
	SUBDIR += portsreinstall
	SUBDIR += porttools
	SUBDIR += porttree
	diff --git a/ports-mgmt/pkg-devel/Makefile b/ports-mgmt/pkg-devel/Makefile
	--- a/ports-mgmt/pkg-devel/Makefile
	+++ b/ports-mgmt/pkg-devel/Makefile
	@@ -39,7 +39,7 @@
	.endif

	# TODO: activate in april 2021
	-#.if ${OPSYS} == FreeBSD && ${OSVERSION} > 1400000
	+#.if ${OPSYS} == FreeBSD
	#CONFIGURE_ARGS+= --default-format=tzst
	#.endif

	diff --git a/ports-mgmt/pkg-provides/Makefile b/ports-mgmt/pkg-provides/Makefile
	--- a/ports-mgmt/pkg-provides/Makefile
	+++ b/ports-mgmt/pkg-provides/Makefile
	@@ -9,7 +9,7 @@
	LICENSE= BSD2CLAUSE BSD3CLAUSE BSD4CLAUSE
	LICENSE_COMB= multi

	-NOT_FOR_ARCHS= armv6 mips mips64
	+NOT_FOR_ARCHS= armv6

	BUILD_DEPENDS= ${LOCALBASE}/include/uthash.h:devel/uthash
	LIB_DEPENDS= libpcre2-8.so:devel/pcre2
	diff --git a/ports-mgmt/portsnap/Makefile b/ports-mgmt/portsnap/Makefile
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/Makefile
	+++ /dev/null
	@@ -1,44 +0,0 @@
	-PORTNAME= portsnap
	-PORTVERSION= 1.1
	-PORTREVISION= 3
	-CATEGORIES= ports-mgmt net
	-MASTER_SITES= http://www.daemonology.net/portsnap/
	-
	-MAINTAINER= bofh@FreeBSD.org
	-COMMENT= Provides secure snapshots of the ports directory
	-WWW= http://www.daemonology.net/portsnap/
	-
	-LICENSE= BSD2CLAUSE
	-
	-DEPRECATED= portsnap infrastructure will be removed after the EOL of 13.x
	-EXPIRATION_DATE=2026-04-30
	-
	-SUB_FILES= pkg-message
	-
	-PLIST_FILES= "@sample etc/portsnap.conf.sample" \
	- libexec/make_index \
	- sbin/portsnap \
	- share/man/man5/portsnap.conf.5.gz \
	- share/man/man8/portsnap.8.gz
	-
	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400087
	-IGNORE= portsnap is in base systems and has been removed from 14.0-RELEASE
	-.endif
	-
	-post-patch:
	- ${REINPLACE_CMD} -e "s,%%PREFIX%%,${PREFIX},g" \
	- ${WRKSRC}/portsnap \
	- ${WRKSRC}/portsnap.conf.5 \
	- ${WRKSRC}/portsnap.8
	-
	-do-install:
	- ${INSTALL_SCRIPT} ${WRKSRC}/portsnap ${STAGEDIR}/${PREFIX}/sbin
	- ${INSTALL_PROGRAM} ${WRKSRC}/make_index ${STAGEDIR}/${PREFIX}/libexec
	- ${INSTALL_MAN} ${WRKSRC}/portsnap.conf.5 ${STAGEDIR}/${PREFIX}/share/man/man5/
	- ${INSTALL_MAN} ${WRKSRC}/portsnap.8 ${STAGEDIR}/${PREFIX}/share/man/man8/
	- ${INSTALL_DATA} ${WRKSRC}/portsnap.conf \
	- ${STAGEDIR}/${PREFIX}/etc/portsnap.conf.sample
	-
	-.include <bsd.port.post.mk>
	diff --git a/ports-mgmt/portsnap/distinfo b/ports-mgmt/portsnap/distinfo
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/distinfo
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-TIMESTAMP = 1681052114
	-SHA256 (portsnap-1.1.tar.gz) = 08bf6db8738d5c4fe757737d97366e7e899a6d0cfb244a46055f97f4b116b36c
	-SIZE (portsnap-1.1.tar.gz) = 20875
	diff --git a/ports-mgmt/portsnap/files/patch-Makefile b/ports-mgmt/portsnap/files/patch-Makefile
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-Makefile
	+++ /dev/null
	@@ -1,12 +0,0 @@
	---- Makefile.orig 2023-04-09 15:24:50 UTC
	-+++ Makefile
	-@@ -1,8 +1,6 @@
	--all: make_index phttpget
	-+all: make_index
	-
	- make_index: make_index.c
	--
	--phttpget: phttpget.c
	-
	- install:
	- install -m 555 portsnap /usr/local/sbin
	diff --git a/ports-mgmt/portsnap/files/patch-make__index.c b/ports-mgmt/portsnap/files/patch-make__index.c
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-make__index.c
	+++ /dev/null
	@@ -1,18 +0,0 @@
	---- make_index.c.orig 2023-04-09 15:19:46 UTC
	-+++ make_index.c
	-@@ -1,4 +1,6 @@
	- /*-
	-+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
	-+ *
	- * Copyright 2005 Colin Percival
	- * All rights reserved
	- *
	-@@ -25,7 +27,7 @@
	- */
	-
	- #include <sys/cdefs.h>
	--__FBSDID("$FreeBSD: src/usr.sbin/portsnap/make_index/make_index.c,v 1.5 2005/12/01 22:14:44 cperciva Exp $");
	-+__FBSDID("$FreeBSD$");
	-
	- #include <err.h>
	- #include <stdio.h>
	diff --git a/ports-mgmt/portsnap/files/patch-portsnap b/ports-mgmt/portsnap/files/patch-portsnap
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-portsnap
	+++ /dev/null
	@@ -1,654 +0,0 @@
	---- portsnap.orig 2006-05-26 23:24:34 UTC
	-+++ portsnap
	-@@ -1,11 +1,13 @@
	- #!/bin/sh
	-
	- #-
	-+# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
	-+#
	- # Copyright 2004-2005 Colin Percival
	- # All rights reserved
	- #
	- # Redistribution and use in source and binary forms, with or without
	--# modification, are permitted providing that the following conditions
	-+# modification, are permitted providing that the following conditions
	- # are met:
	- # 1. Redistributions of source code must retain the above copyright
	- # notice, this list of conditions and the following disclaimer.
	-@@ -25,7 +27,7 @@
	- # IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	- # POSSIBILITY OF SUCH DAMAGE.
	-
	--# $FreeBSD: src/usr.sbin/portsnap/portsnap/portsnap.sh,v 1.24 2006/05/13 15:56:35 cperciva Exp $
	-+# $FreeBSD$
	-
	- #### Usage function -- called from command-line handling code.
	-
	-@@ -38,7 +40,7 @@ usage: `basename $0` [options] command ... [path]
	-
	- Options:
	- -d workdir -- Store working files in workdir
	-- (default: ${PREFIX}/portsnap/)
	-+ (default: /var/db/portsnap/)
	- -f conffile -- Read configuration options from conffile
	- (default: ${PREFIX}/etc/portsnap.conf)
	- -I -- Update INDEX only. (update command only)
	-@@ -48,6 +50,9 @@ Options:
	- (default: /usr/ports/)
	- -s server -- Server from which to fetch updates.
	- (default: portsnap.FreeBSD.org)
	-+ --interactive -- interactive: override auto-detection of calling process
	-+ (use this when calling portsnap from an interactive, non-
	-+ terminal application AND NEVER ELSE).
	- path -- Extract only parts of the tree starting with the given
	- string. (extract command only)
	- Commands:
	-@@ -58,6 +63,8 @@ Commands:
	- files and directories.
	- update -- Update ports tree to match current snapshot, replacing
	- files and directories which have changed.
	-+ auto -- Fetch updates, and either extract a new ports tree or
	-+ update an existing tree.
	- EOF
	- exit 0
	- }
	-@@ -81,10 +88,11 @@ init_params() {
	- NDEBUG=""
	- DDSTATS=""
	- INDEXONLY=""
	-- PREFIX="/usr/local"
	-+ PREFIX="%%PREFIX%%"
	- SERVERNAME=""
	- REFUSE=""
	- LOCALDESC=""
	-+ INTERACTIVE=""
	- }
	-
	- # Parse the command line
	-@@ -104,6 +112,9 @@ parse_cmdline() {
	- XARGST="-t"
	- DDSTATS=".."
	- ;;
	-+ --interactive)
	-+ INTERACTIVE="YES"
	-+ ;;
	- -f)
	- if [ $# -eq 1 ]; then usage; fi
	- if [ ! -z "${CONFFILE}" ]; then usage; fi
	-@@ -141,9 +152,15 @@ parse_cmdline() {
	- if [ ! -z "${SERVERNAME}" ]; then usage; fi
	- shift; SERVERNAME="$1"
	- ;;
	-- cron \| extract \| fetch \| update)
	-+ cron \| extract \| fetch \| update \| auto)
	- COMMANDS="${COMMANDS} $1"
	- ;;
	-+ up)
	-+ COMMANDS="${COMMANDS} update"
	-+ ;;
	-+ alfred)
	-+ COMMANDS="${COMMANDS} auto"
	-+ ;;
	- *)
	- if [ $# -gt 1 ]; then usage; fi
	- if echo ${COMMANDS} \| grep -vq extract; then
	-@@ -200,6 +217,12 @@ parse_conffile() {
	- cut -c 7- \| xargs echo \| tr ' ' '\|'
	- `)"
	- fi
	-+
	-+ if grep -qE "^INDEX[[:space:]]" ${CONFFILE}; then
	-+ INDEXPAIRS="`
	-+ grep -E "^INDEX[[:space:]]" "${CONFFILE}" \|
	-+ cut -c 7- \| tr ' ' '\|' \| xargs echo`"
	-+ fi
	- fi
	- }
	-
	-@@ -208,7 +231,7 @@ default_params() {
	- _QUIETREDIR="/dev/null"
	- _QUIETFLAG="-q"
	- _STATSREDIR="/dev/stdout"
	-- _WORKDIR="${PREFIX}/portsnap"
	-+ _WORKDIR="/var/db/portsnap"
	- _PORTSDIR="/usr/ports"
	- _NDEBUG="-n"
	- _LOCALDESC="/dev/null"
	-@@ -220,13 +243,20 @@ default_params() {
	- eval ${X}=${__}
	- fi
	- done
	-+ if [ -z "${INTERACTIVE}" ]; then
	-+ if [ -t 0 ]; then
	-+ INTERACTIVE="YES"
	-+ else
	-+ INTERACTIVE="NO"
	-+ fi
	-+ fi
	- }
	-
	- # Perform sanity checks and set some final parameters
	- # in preparation for fetching files. Also chdir into
	- # the working directory.
	- fetch_check_params() {
	-- export HTTP_USER_AGENT="portsnap/1.1 (${COMMAND})"
	-+ export HTTP_USER_AGENT="portsnap (${COMMAND}, `uname -r`)"
	-
	- _SERVERNAME_z=\
	- "SERVERNAME must be given via command line or configuration file."
	-@@ -258,28 +288,9 @@ fetch_check_params() {
	- fi
	- cd ${WORKDIR} \|\| exit 1
	-
	-- BSPATCH=`which bspatch \|\| echo ${PREFIX}/bin/bspatch`
	-- SHA256=`which sha256 \|\| echo ${PREFIX}/sbin/sha256`
	-- PHTTPGET=${PREFIX}/libexec/phttpget
	-- if ! [ -x ${BSPATCH} ]; then
	-- echo -n "`basename $0`: "
	-- echo "bspatch is needed but cannot be found."
	-- echo -n "Please install it from the ports tree "
	-- echo "(misc/bsdiff)."
	-- exit 1
	-- fi
	-- if ! [ -x ${SHA256} ]; then
	-- echo -n "`basename $0`: "
	-- echo "sha256 is needed but cannot be found."
	-- echo -n "Please install it from the ports tree "
	-- echo "(sysutils/freebsd-sha256)."
	-- exit 1
	-- fi
	-- if ! [ -x ${PHTTPGET} ]; then
	-- echo -n "`basename $0`: "
	-- echo "Cannot find ${PHTTPGET}."
	-- exit 1
	-- fi
	-+ BSPATCH=/usr/bin/bspatch
	-+ SHA256=/sbin/sha256
	-+ PHTTPGET=/usr/libexec/phttpget
	- }
	-
	- # Perform sanity checks and set some final parameters
	-@@ -311,11 +322,6 @@ extract_check_params() {
	- fi
	-
	- MKINDEX=${PREFIX}/libexec/make_index
	-- if ! [ -x ${MKINDEX} ]; then
	-- echo -n "`basename $0`: "
	-- echo "Cannot find ${MKINDEX}."
	-- exit 1
	-- fi
	- }
	-
	- # Perform sanity checks and set some final parameters
	-@@ -364,7 +370,7 @@ fetch_pick_server_init() {
	- # "$name server selection ..."; we allow either format.
	- MLIST="_http._tcp.${SERVERNAME}"
	- host -t srv "${MLIST}" \|
	-- sed -nE "s/${MLIST} (has SRV record\|server selection) //p" \|
	-+ sed -nE "s/${MLIST} (has SRV record\|server selection) //Ip" \|
	- cut -f 1,2,4 -d ' ' \|
	- sed -e 's/\.$//' \|
	- sort > serverlist_full
	-@@ -406,7 +412,7 @@ fetch_pick_server() {
	- SRV_PRIORITY=`cut -f 1 -d ' ' serverlist \| sort -n \| head -1`
	-
	- # Add up the weights of the response lines at that priority level.
	-- SRV_WSUM=0;
	-+ SRV_WSUM=0
	- while read X; do
	- case "$X" in
	- ${SRV_PRIORITY}\ *)
	-@@ -555,9 +561,9 @@ fetch_metadata() {
	- rm -f ${SNAPSHOTHASH} tINDEX.new
	-
	- echo ${NDEBUG} "Fetching snapshot metadata... "
	-- fetch ${QUIETFLAG} http://${SERVERNAME}/t/${SNAPSHOTHASH}
	-+ fetch ${QUIETFLAG} http://${SERVERNAME}/t/${SNAPSHOTHASH} \
	- 2>${QUIETREDIR} \|\| return
	-- if [ `${SHA256} -q ${SNAPSHOTHASH}` != ${SNAPSHOTHASH} ]; then
	-+ if [ "`${SHA256} -q ${SNAPSHOTHASH}`" != ${SNAPSHOTHASH} ]; then
	- echo "snapshot metadata corrupt."
	- return 1
	- fi
	-@@ -589,14 +595,15 @@ fetch_metadata_sanity() {
	-
	- # Take a list of ${oldhash}\|${newhash} and output a list of needed patches
	- fetch_make_patchlist() {
	-- grep -vE "^([0-9a-f]{64})\\|\1$" \|
	-- while read LINE; do
	-- X=`echo ${LINE} \| cut -f 1 -d '\|'`
	-- Y=`echo ${LINE} \| cut -f 2 -d '\|'`
	-- if [ -f "files/${Y}.gz" ]; then continue; fi
	-- if [ ! -f "files/${X}.gz" ]; then continue; fi
	-- echo "${LINE}"
	-+ local IFS='\|'
	-+ echo "" 1>${QUIETREDIR}
	-+ grep -vE "^([0-9a-f]{64})\\|\1$" \|
	-+ while read X Y; do
	-+ printf "Processing: $X $Y ...\r" 1>${QUIETREDIR}
	-+ if [ -f "files/${Y}.gz" -o ! -f "files/${X}.gz" ]; then continue; fi
	-+ echo "${X}\|${Y}"
	- done
	-+ echo "" 1>${QUIETREDIR}
	- }
	-
	- # Print user-friendly progress statistics
	-@@ -613,6 +620,30 @@ fetch_progress() {
	- echo -n " "
	- }
	-
	-+pct_fmt()
	-+{
	-+ if [ $TOTAL -gt 0 ]; then
	-+ printf " \r"
	-+ printf "($1/$2) %02.2f%% " `echo "scale=4;$LNC / $TOTAL * 100"\|bc`
	-+ fi
	-+}
	-+
	-+fetch_progress_percent() {
	-+ TOTAL=$1
	-+ LNC=0
	-+ pct_fmt $LNC $TOTAL
	-+ while read x; do
	-+ LNC=$(($LNC + 1))
	-+ if [ $(($LNC % 100)) = 0 ]; then
	-+ pct_fmt $LNC $TOTAL
	-+ elif [ $(($LNC % 10)) = 0 ]; then
	-+ echo -n .
	-+ fi
	-+ done
	-+ pct_fmt $LNC $TOTAL
	-+ echo " done. "
	-+}
	-+
	- # Sanity-check an index file
	- fetch_index_sanity() {
	- if grep -qvE "^[-_+./@0-9A-Za-z]+\\|[0-9a-f]{64}$" INDEX.new \|\|
	-@@ -625,7 +656,7 @@ fetch_index_sanity() {
	- # Verify a list of files
	- fetch_snapshot_verify() {
	- while read F; do
	-- if [ `gunzip -c snap/${F} \| ${SHA256} -q` != ${F} ]; then
	-+ if [ "`gunzip -c < snap/${F}.gz \| ${SHA256} -q`" != ${F} ]; then
	- echo "snapshot corrupt."
	- return 1
	- fi
	-@@ -651,7 +682,7 @@ fetch_snapshot() {
	- fetch -r http://${SERVERNAME}/s/${SNAPSHOTHASH}.tgz \|\| return 1
	-
	- echo -n "Extracting snapshot... "
	-- tar -xzf ${SNAPSHOTHASH}.tgz snap/ \|\| return 1
	-+ tar -xz --numeric-owner -f ${SNAPSHOTHASH}.tgz snap/ \|\| return 1
	- rm ${SNAPSHOTHASH}.tgz
	- echo "done."
	-
	-@@ -660,11 +691,19 @@ fetch_snapshot() {
	- cut -f 2 -d '\|' tINDEX.new \| fetch_snapshot_verify \|\| return 1
	- # Extract the index
	- rm -f INDEX.new
	-- gunzip -c snap/`look INDEX tINDEX.new \|
	-+ gunzip -c < snap/`look INDEX tINDEX.new \|
	- cut -f 2 -d '\|'`.gz > INDEX.new
	- fetch_index_sanity \|\| return 1
	- # Verify the snapshot contents
	- cut -f 2 -d '\|' INDEX.new \| fetch_snapshot_verify \|\| return 1
	-+ cut -f 2 -d '\|' tINDEX.new INDEX.new \| sort -u \|
	-+ lam -s 'snap/' - -s '.gz' > files.expected
	-+ find snap -mindepth 1 \| sort > files.snap
	-+ if ! cmp -s files.expected files.snap; then
	-+ echo "unexpected files in snapshot."
	-+ return 1
	-+ fi
	-+ rm files.expected files.snap
	- echo "done."
	-
	- # Move files into their proper locations
	-@@ -711,9 +750,8 @@ fetch_update() {
	-
	- # Attempt to apply metadata patches
	- echo -n "Applying metadata patches... "
	-- while read LINE; do
	-- X=`echo ${LINE} \| cut -f 1 -d '\|'`
	-- Y=`echo ${LINE} \| cut -f 2 -d '\|'`
	-+ local oldifs="$IFS" IFS='\|'
	-+ while read X Y; do
	- if [ ! -f "${X}-${Y}.gz" ]; then continue; fi
	- gunzip -c < ${X}-${Y}.gz > diff
	- gunzip -c < files/${X}.gz > OLD
	-@@ -726,6 +764,7 @@ fetch_update() {
	- fi
	- rm -f diff OLD NEW ${X}-${Y}.gz ptmp
	- done < patchlist 2>${QUIETREDIR}
	-+ IFS="$oldifs"
	- echo "done."
	-
	- # Update metadata without patches
	-@@ -733,7 +772,7 @@ fetch_update() {
	- cut -f 2 -d '\|' /dev/stdin patchlist \|
	- while read Y; do
	- if [ ! -f "files/${Y}.gz" ]; then
	-- echo ${Y};
	-+ echo ${Y}
	- fi
	- done > filelist
	- echo -n "Fetching `wc -l < filelist \| tr -d ' '` "
	-@@ -743,17 +782,20 @@ fetch_update() {
	- 2>${QUIETREDIR}
	-
	- while read Y; do
	-+ echo -n "Verifying ${Y}... " 1>${QUIETREDIR}
	- if [ `gunzip -c < ${Y}.gz \| ${SHA256} -q` = ${Y} ]; then
	- mv ${Y}.gz files/${Y}.gz
	- else
	- echo "metadata is corrupt."
	- return 1
	- fi
	-+ echo "ok." 1>${QUIETREDIR}
	- done < filelist
	- echo "done."
	-
	- # Extract the index
	-- gunzip -c files/`look INDEX tINDEX.new \|
	-+ echo -n "Extracting index... " 1>${QUIETREDIR}
	-+ gunzip -c < files/`look INDEX tINDEX.new \|
	- cut -f 2 -d '\|'`.gz > INDEX.new
	- fetch_index_sanity \|\| return 1
	-
	-@@ -773,23 +815,39 @@ fetch_update() {
	- fi
	-
	- # Generate a list of wanted ports patches
	-+ echo -n "Generating list of wanted patches..." 1>${QUIETREDIR}
	- join -t '\|' -o 1.2,2.2 INDEX INDEX.new \|
	- fetch_make_patchlist > patchlist
	-+ echo " done." 1>${QUIETREDIR}
	-
	- # Attempt to fetch ports patches
	-- echo -n "Fetching `wc -l < patchlist \| tr -d ' '` "
	-+ patchcnt=`wc -l < patchlist \| tr -d ' '`
	-+ echo -n "Fetching $patchcnt "
	- echo ${NDEBUG} "patches.${DDSTATS}"
	-+ echo " "
	- tr '\|' '-' < patchlist \| lam -s "bp/" - \|
	- xargs ${XARGST} ${PHTTPGET} ${SERVERNAME} \
	-- 2>${STATSREDIR} \| fetch_progress
	-+ 2>${STATSREDIR} \| fetch_progress_percent $patchcnt
	- echo "done."
	-
	- # Attempt to apply ports patches
	-- echo -n "Applying patches... "
	-- while read LINE; do
	-- X=`echo ${LINE} \| cut -f 1 -d '\|'`
	-- Y=`echo ${LINE} \| cut -f 2 -d '\|'`
	-- if [ ! -f "${X}-${Y}" ]; then continue; fi
	-+ PATCHCNT=`wc -l patchlist`
	-+ echo "Applying patches... "
	-+ local oldifs="$IFS" IFS='\|'
	-+ I=0
	-+ while read X Y; do
	-+ I=$(($I + 1))
	-+ F="${X}-${Y}"
	-+ if [ ! -f "${F}" ]; then
	-+ XS=${X%[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
	-+ XE=${X#[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
	-+ YS=${Y%[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
	-+ YE=${Y#[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
	-+ F="${X%${XE}}...${X#${XS}}-${Y%${YE}}...${Y#${YS}}"
	-+ printf " Skipping ${F} (${I} of ${PATCHCNT}).\r"
	-+ continue
	-+ fi
	-+ echo " Processing ${F}..." 1>${QUIETREDIR}
	- gunzip -c < files/${X}.gz > OLD
	- ${BSPATCH} OLD NEW ${X}-${Y}
	- if [ `${SHA256} -q NEW` = ${Y} ]; then
	-@@ -798,6 +856,7 @@ fetch_update() {
	- fi
	- rm -f diff OLD NEW ${X}-${Y}
	- done < patchlist 2>${QUIETREDIR}
	-+ IFS="$oldifs"
	- echo "done."
	-
	- # Update ports without patches
	-@@ -805,7 +864,7 @@ fetch_update() {
	- cut -f 2 -d '\|' /dev/stdin patchlist \|
	- while read Y; do
	- if [ ! -f "files/${Y}.gz" ]; then
	-- echo ${Y};
	-+ echo ${Y}
	- fi
	- done > filelist
	- echo -n "Fetching `wc -l < filelist \| tr -d ' '` "
	-@@ -814,7 +873,10 @@ fetch_update() {
	- xargs ${XARGST} ${PHTTPGET} ${SERVERNAME} \
	- 2>${QUIETREDIR}
	-
	-+ I=0
	- while read Y; do
	-+ I=$(($I + 1))
	-+ printf " Processing ${Y} (${I} of ${PATCHCNT}).\r" 1>${QUIETREDIR}
	- if [ `gunzip -c < ${Y}.gz \| ${SHA256} -q` = ${Y} ]; then
	- mv ${Y}.gz files/${Y}.gz
	- else
	-@@ -825,8 +887,8 @@ fetch_update() {
	- echo "done."
	-
	- # Remove files which are no longer needed
	-- cut -f 2 -d '\|' tINDEX INDEX \| sort > oldfiles
	-- cut -f 2 -d '\|' tINDEX.new INDEX.new \| sort \| comm -13 - oldfiles \|
	-+ cut -f 2 -d '\|' tINDEX INDEX \| sort -u > oldfiles
	-+ cut -f 2 -d '\|' tINDEX.new INDEX.new \| sort -u \| comm -13 - oldfiles \|
	- lam -s "files/" - -s ".gz" \| xargs rm -f
	- rm patchlist filelist oldfiles
	-
	-@@ -854,18 +916,25 @@ fetch_run() {
	-
	- # Build a ports INDEX file
	- extract_make_index() {
	-- gunzip -c "${WORKDIR}/files/`look $1 ${WORKDIR}/tINDEX \|
	-+ if ! look $1 ${WORKDIR}/tINDEX > /dev/null; then
	-+ echo -n "$1 not provided by portsnap server; "
	-+ echo "$2 not being generated."
	-+ else
	-+ gunzip -c < "${WORKDIR}/files/`look $1 ${WORKDIR}/tINDEX \|
	- cut -f 2 -d '\|'`.gz" \|
	- cat - ${LOCALDESC} \|
	- ${MKINDEX} /dev/stdin > ${PORTSDIR}/$2
	-+ fi
	- }
	-
	- # Create INDEX, INDEX-5, INDEX-6
	- extract_indices() {
	- echo -n "Building new INDEX files... "
	-- extract_make_index DESCRIBE.4 INDEX \|\| return 1
	-- extract_make_index DESCRIBE.5 INDEX-5 \|\| return 1
	-- extract_make_index DESCRIBE.6 INDEX-6 \|\| return 1
	-+ for PAIR in ${INDEXPAIRS}; do
	-+ INDEXFILE=`echo ${PAIR} \| cut -f 1 -d '\|'`
	-+ DESCRIBEFILE=`echo ${PAIR} \| cut -f 2 -d '\|'`
	-+ extract_make_index ${DESCRIBEFILE} ${INDEXFILE} \|\| return 1
	-+ done
	- echo "done."
	- }
	-
	-@@ -889,6 +958,7 @@ extract_metadata() {
	-
	- # Do the actual work involved in "extract"
	- extract_run() {
	-+ local oldifs="$IFS" IFS='\|'
	- mkdir -p ${PORTSDIR} \|\| return 1
	-
	- if !
	-@@ -898,25 +968,22 @@ extract_run() {
	- grep -vE "${REFUSE}" ${WORKDIR}/INDEX
	- else
	- cat ${WORKDIR}/INDEX
	-- fi \| while read LINE; do
	-- FILE=`echo ${LINE} \| cut -f 1 -d '\|'`
	-- HASH=`echo ${LINE} \| cut -f 2 -d '\|'`
	-+ fi \| while read FILE HASH; do
	- echo ${PORTSDIR}/${FILE}
	-- if ! [ -r "${WORKDIR}/files/${HASH}.gz" ]; then
	-+ if ! [ -s "${WORKDIR}/files/${HASH}.gz" ]; then
	- echo "files/${HASH}.gz not found -- snapshot corrupt."
	- return 1
	- fi
	- case ${FILE} in
	- */)
	-- DIR=`echo ${FILE} \| sed -e 's\|/$\|\|'`
	-- rm -rf ${PORTSDIR}/${DIR}
	-+ rm -rf ${PORTSDIR}/${FILE%/}
	- mkdir -p ${PORTSDIR}/${FILE}
	-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
	-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
	- -C ${PORTSDIR}/${FILE}
	- ;;
	- *)
	- rm -f ${PORTSDIR}/${FILE}
	-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
	-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
	- -C ${PORTSDIR} ${FILE}
	- ;;
	- esac
	-@@ -924,13 +991,49 @@ extract_run() {
	- return 1
	- fi
	- if [ ! -z "${EXTRACTPATH}" ]; then
	-- return 0;
	-+ return 0
	- fi
	-
	-+ IFS="$oldifs"
	-+
	- extract_metadata
	- extract_indices
	- }
	-
	-+update_run_extract() {
	-+ local IFS='\|'
	-+
	-+# Install new files
	-+ echo "Extracting new files:"
	-+ if !
	-+ if ! [ -z "${REFUSE}" ]; then
	-+ grep -vE "${REFUSE}" ${WORKDIR}/INDEX \| sort
	-+ else
	-+ sort ${WORKDIR}/INDEX
	-+ fi \|
	-+ comm -13 ${PORTSDIR}/.portsnap.INDEX - \|
	-+ while read FILE HASH; do
	-+ echo ${PORTSDIR}/${FILE}
	-+ if ! [ -s "${WORKDIR}/files/${HASH}.gz" ]; then
	-+ echo "files/${HASH}.gz not found -- snapshot corrupt."
	-+ return 1
	-+ fi
	-+ case ${FILE} in
	-+ */)
	-+ mkdir -p ${PORTSDIR}/${FILE}
	-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
	-+ -C ${PORTSDIR}/${FILE}
	-+ ;;
	-+ *)
	-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
	-+ -C ${PORTSDIR} ${FILE}
	-+ ;;
	-+ esac
	-+ done; then
	-+ return 1
	-+ fi
	-+}
	-+
	- # Do the actual work involved in "update"
	- update_run() {
	- if ! [ -z "${INDEXONLY}" ]; then
	-@@ -947,7 +1050,7 @@ update_run() {
	- # If we are REFUSEing to touch certain directories, don't remove files
	- # from those directories (even if they are out of date)
	- echo -n "Removing old files and directories... "
	-- if ! [ -z "${REFUSE}" ]; then
	-+ if ! [ -z "${REFUSE}" ]; then
	- sort ${WORKDIR}/INDEX \|
	- comm -23 ${PORTSDIR}/.portsnap.INDEX - \| cut -f 1 -d '\|' \|
	- grep -vE "${REFUSE}" \|
	-@@ -961,38 +1064,7 @@ update_run() {
	- fi
	- echo "done."
	-
	--# Install new files
	-- echo "Extracting new files:"
	-- if !
	-- if ! [ -z "${REFUSE}" ]; then
	-- grep -vE "${REFUSE}" ${WORKDIR}/INDEX \| sort
	-- else
	-- sort ${WORKDIR}/INDEX
	-- fi \|
	-- comm -13 ${PORTSDIR}/.portsnap.INDEX - \|
	-- while read LINE; do
	-- FILE=`echo ${LINE} \| cut -f 1 -d '\|'`
	-- HASH=`echo ${LINE} \| cut -f 2 -d '\|'`
	-- echo ${PORTSDIR}/${FILE}
	-- if ! [ -r "${WORKDIR}/files/${HASH}.gz" ]; then
	-- echo "files/${HASH}.gz not found -- snapshot corrupt."
	-- return 1
	-- fi
	-- case ${FILE} in
	-- */)
	-- mkdir -p ${PORTSDIR}/${FILE}
	-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
	-- -C ${PORTSDIR}/${FILE}
	-- ;;
	-- *)
	-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
	-- -C ${PORTSDIR} ${FILE}
	-- ;;
	-- esac
	-- done; then
	-- return 1
	-- fi
	--
	-+ update_run_extract \|\| return 1
	- extract_metadata
	- extract_indices
	- }
	-@@ -1013,10 +1085,10 @@ get_params() {
	- # Fetch command. Make sure that we're being called
	- # interactively, then run fetch_check_params and fetch_run
	- cmd_fetch() {
	-- if [ ! -t 0 ]; then
	-+ if [ "${INTERACTIVE}" != "YES" ]; then
	- echo -n "`basename $0` fetch should not "
	- echo "be run non-interactively."
	-- echo "Run `basename $0` cron instead."
	-+ echo "Run `basename $0` cron instead"
	- exit 1
	- fi
	- fetch_check_params
	-@@ -1055,10 +1127,29 @@ cmd_update() {
	- update_run \|\| exit 1
	- }
	-
	-+# Auto command. Run 'fetch' or 'cron' depending on
	-+# whether stdin is a terminal; then run 'update' or
	-+# 'extract' depending on whether ${PORTSDIR} exists.
	-+cmd_auto() {
	-+ if [ "${INTERACTIVE}" = "YES" ]; then
	-+ cmd_fetch
	-+ else
	-+ cmd_cron
	-+ fi
	-+ if [ -r ${PORTSDIR}/.portsnap.INDEX ]; then
	-+ cmd_update
	-+ else
	-+ cmd_extract
	-+ fi
	-+}
	-+
	- #### Entry point
	-
	- # Make sure we find utilities from the base system
	- export PATH=/sbin:/bin:/usr/sbin:/usr/bin:${PATH}
	-+
	-+# Set LC_ALL in order to avoid problems with character ranges like [A-Z].
	-+export LC_ALL=C
	-
	- get_params $@
	- for COMMAND in ${COMMANDS}; do
	diff --git a/ports-mgmt/portsnap/files/patch-portsnap.8 b/ports-mgmt/portsnap/files/patch-portsnap.8
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-portsnap.8
	+++ /dev/null
	@@ -1,183 +0,0 @@
	---- portsnap.8.orig 2006-05-26 23:21:29 UTC
	-+++ portsnap.8
	-@@ -23,9 +23,9 @@
	- .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	- .\" POSSIBILITY OF SUCH DAMAGE.
	- .\"
	--.\" $FreeBSD: src/usr.sbin/portsnap/portsnap/portsnap.8,v 1.9 2006/05/13 18:04:48 cperciva Exp $
	-+.\" $FreeBSD$
	- .\"
	--.Dd August 13, 2005
	-+.Dd July 1, 2018
	- .Dt PORTSNAP 8
	- .Os FreeBSD
	- .Sh NAME
	-@@ -50,20 +50,25 @@ of the
	- .Fx
	- ports tree, and extract and update an
	- uncompressed ports tree.
	-+.Pp
	-+In a normal update operation,
	-+.Nm
	-+will routinely restore modified files to their unmodified state and
	-+delete unrecognized local files.
	- .Sh OPTIONS
	- The following options are supported:
	- .Bl -tag -width "-f conffile"
	- .It Fl d Ar workdir
	--Store working files (e.g. downloaded updates) in
	-+Store working files (e.g.\& downloaded updates) in
	- .Ar workdir .
	- (default:
	--.Pa $PREFIX/portsnap ,
	-+.Pa /var/db/portsnap ,
	- or as given in the configuration file.)
	- .It Fl f Ar conffile
	--Read the configuration from from
	-+Read the configuration from
	- .Ar conffile .
	- (default:
	--.Pa $PREFIX/etc/portsnap.conf )
	-+.Pa %%PREFIX%%/etc/portsnap.conf )
	- .It Fl I
	- For the
	- .Cm update
	-@@ -72,7 +77,7 @@ command, update INDEX files, but not the rest of the p
	- Expect a public key with given SHA256 hash.
	- (default: read value from configuration file.)
	- .It Fl l Ar descfile
	--Merge the specified local describes file into the INDEX files being
	-+Merge the specified local describes file into the INDEX files being
	- built.
	- The
	- .Ar descfile
	-@@ -88,25 +93,30 @@ operate on the directory
	- or as given in the configuration file.)
	- .It Fl s Ar server
	- Fetch files from the specified server or server pool.
	--(default: portsnap.FreeBSD.org , or as given in the
	-+(default: portsnap.FreeBSD.org, or as given in the
	- configuration file.)
	- .It path
	- For
	- .Cm extract
	- command only, operate only on parts of the ports tree starting with
	- .Ar path .
	--(e.g.
	-+(e.g.\&
	- .Nm
	--.cm extract
	-+.Cm extract
	- .Ar sysutils/port
	- would extract sysutils/portsman, sysutils/portsnap,
	- sysutils/portupgrade, etc.)
	-+.It Fl Fl interactive
	-+override auto-detection of calling process.
	-+Only use this when calling portsnap from an
	-+.Sy interactive, non-terminal application.
	-+(Cron jobs are particularly bad since they cause
	-+load spikes on the Portsnap mirrors.)
	- .El
	- .Sh COMMANDS
	- The
	- .Cm command
	- can be any one of the following:
	--.Pp
	- .Bl -tag -width "-f conffile"
	- .It fetch
	- Fetch a compressed snapshot of the ports tree, or update
	-@@ -151,21 +161,52 @@ or
	- commands.
	- Again, note that in the parts of the ports tree which are being
	- updated, any local changes or additions will be removed.
	-+.It auto
	-+Run
	-+.Cm fetch
	-+or
	-+.Cm cron
	-+depending on whether stdin is a terminal; then run
	-+.Cm update
	-+or
	-+.Cm extract
	-+depending on whether
	-+.Ar portsdir
	-+exists.
	- .El
	- .Sh TIPS
	- .Bl -bullet
	- .It
	- If your clock is set to local time, adding the line
	- .Pp
	--.Dl 0 3 * * * root /usr/local/sbin/portsnap cron
	-+.Dl 0 3 * * * root %%PREFIX%%/sbin/portsnap cron
	- .Pp
	--to /etc/crontab is a good way to make sure you always have
	-+to
	-+.Pa /etc/crontab
	-+is a good way to make sure you always have
	- an up-to-date snapshot of the ports tree available which
	- can quickly be extracted into
	- .Pa /usr/ports .
	- If your clock is set to UTC, please pick a random time other
	- than 3AM, to avoid overly imposing an uneven load on the
	- server(s) hosting the snapshots.
	-+.Pp
	-+Note that running
	-+.Nm
	-+.Cm cron
	-+or
	-+.Nm
	-+.Cm fetch
	-+does not apply the changes that were received: they only download
	-+them.
	-+To apply the changes, you must follow these commands with
	-+.Nm
	-+.Cm update .
	-+The
	-+.Nm
	-+.Cm update
	-+command is normally run by hand at a time when you are sure that
	-+no one is manually working in the ports tree.
	- .It
	- Running
	- .Nm
	-@@ -183,7 +224,7 @@ However, running
	- .Fl I
	- .Cm update
	- is probably safe, and can be used together with
	--.Xr portversion 1
	-+.Xr pkg-version 8
	- to identify installed software which is out of date.
	- .It
	- If you wish to use
	-@@ -206,22 +247,22 @@ of files are not needed by any particular client.
	- .Sh PRIVACY NOTICE
	- As an unavoidable part of its operation, a machine running
	- .Nm
	--will make its public IP address and the list of files it fetches
	-+will make its public IP address and the list of files it fetches
	- available to the server from which it fetches updates.
	--Using these it may be possible to recognize a machine over an extended
	--period of time, determine when it is updated, and identify which
	--portions of the FreeBSD ports tree, if any, are being ignored using
	-+Using these it may be possible to recognize a machine over an extended
	-+period of time, determine when it is updated, and identify which
	-+portions of the FreeBSD ports tree, if any, are being ignored using
	- "REFUSE" directives in
	- .Pa portsnap.conf .
	- .Pp
	--Statistical data generated from information collected in this manner
	-+Statistical data generated from information collected in this manner
	- may be published, but only in aggregate and after anonymizing the
	- individual systems.
	- .Sh FILES
	--.Bl -tag -width "$PREFIX/etc/portsnap.conf"
	--.It $PREFIX/etc/portsnap.conf
	-+.Bl -tag -width "%%PREFIX%%/etc/portsnap.conf"
	-+.It %%PREFIX%%/etc/portsnap.conf
	- Default location of the portsnap configuration file.
	--.It $PREFIX/portsnap
	-+.It /var/db//portsnap
	- Default location where compressed snapshots are stored.
	- .It /usr/ports
	- Default location where the ports tree is extracted.
	diff --git a/ports-mgmt/portsnap/files/patch-portsnap.conf b/ports-mgmt/portsnap/files/patch-portsnap.conf
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-portsnap.conf
	+++ /dev/null
	@@ -1,21 +0,0 @@
	---- portsnap.conf.orig 2023-04-09 15:47:31 UTC
	-+++ portsnap.conf
	-@@ -1,7 +1,7 @@
	--# $FreeBSD: src/etc/portsnap.conf,v 1.3 2006/01/18 03:40:57 cperciva Exp $
	-+# $FreeBSD$
	-
	- # Default directory where compressed snapshots are stored.
	--# WORKDIR=/usr/local/portsnap
	-+# WORKDIR=/var/db/portsnap
	-
	- # Default location of the ports tree (target for "update" and "extract").
	- # PORTSDIR=/usr/ports
	-@@ -28,3 +28,8 @@ KEYPRINT=9b5feee6d69f170e3dd0a2c8e469ddbd64f13f978f2f3
	- #
	- # REFUSE arabic chinese french german hebrew hungarian japanese
	- # REFUSE korean polish portuguese russian ukrainian vietnamese
	-+
	-+# List of INDEX files to build and the DESCRIBE file to use for each
	-+#INDEX INDEX-12 DESCRIBE.12
	-+#INDEX INDEX-13 DESCRIBE.13
	-+#INDEX INDEX-14 DESCRIBE.14
	diff --git a/ports-mgmt/portsnap/files/patch-portsnap.conf.5 b/ports-mgmt/portsnap/files/patch-portsnap.conf.5
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/patch-portsnap.conf.5
	+++ /dev/null
	@@ -1,65 +0,0 @@
	---- portsnap.conf.5.orig 2006-05-26 23:20:32 UTC
	-+++ portsnap.conf.5
	-@@ -23,7 +23,7 @@
	- .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	- .\" POSSIBILITY OF SUCH DAMAGE.
	- .\"
	--.\" $FreeBSD: src/share/man/man5/portsnap.conf.5,v 1.2 2005/09/06 19:28:37 cperciva Exp $
	-+.\" $FreeBSD$
	- .\"
	- .Dd January 30, 2005
	- .Dt PORTSNAP.CONF 5
	-@@ -68,7 +68,8 @@ snapshot of the ports tree.
	- This is equivalent to the
	- .Fl d Ar workdir
	- option to
	--.Xr portsnap 8 , and will be ignored if the command-line option
	-+.Xr portsnap 8 ,
	-+and will be ignored if the command-line option
	- is used.
	- .Pp
	- A line of the form
	-@@ -82,13 +83,21 @@ commands.
	- This is equivalent to the
	- .Fl p Ar portsdir
	- option to
	--.Xr portsnap 8 , and will be ignored if the command-line option
	-+.Xr portsnap 8 ,
	-+and will be ignored if the command-line option
	- is used.
	- .Pp
	- If more than one line of any of the above forms is included in
	- .Nm
	- then only the last one will take effect.
	- .Pp
	-+A line of the form
	-+.Dl INDEX INDEXFILE DESCRIBEFILE
	-+will instruct
	-+.Xr portsnap 8
	-+that the specified INDEX file is generated from the specified
	-+describe file distributed by the portsnap server.
	-+.Pp
	- Finally, a line of the form
	- .Dl REFUSE foo bar
	- will instruct
	-@@ -123,14 +132,14 @@ supported and may cause unexpected results.
	- .Pp
	- Any lines not of the above forms will be ignored.
	- .Sh FILES
	--.Bl -tag -width "$PREFIX/portsnap.conf"
	--.It $PREFIX/portsnap.conf
	-+.Bl -tag -width "%%PREFIX%%/etc/portsnap.conf"
	-+.It Pa %%PREFIX%/etc/portsnap.conf
	- Default location of the portsnap configuration file.
	- .El
	- .Sh SEE ALSO
	--.Xr egrep 1
	--.Xr fetch 1
	-+.Xr egrep 1 ,
	-+.Xr fetch 1 ,
	-+.Xr sha256 1 ,
	- .Xr portsnap 8
	--.Xr sha256 8
	- .Sh AUTHORS
	--.An Colin Percival Aq cperciva@FreeBSD.org
	-+.An Colin Percival Aq Mt cperciva@FreeBSD.org
	diff --git a/ports-mgmt/portsnap/files/pkg-message.in b/ports-mgmt/portsnap/files/pkg-message.in
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/files/pkg-message.in
	+++ /dev/null
	@@ -1,28 +0,0 @@
	-[
	-{ type: install
	- message: <<EOM
	-Before you can use portsnap, you will have to create an update configuration
	-file specifying the server from which to fetch snapshots and the sha256 hash
	-of the openssl public key which is trusted to sign the snapshots.
	-
	-A sample configuration file has been installed in
	-
	- %%PREFIX%%/etc/portsnap.conf.sample
	-
	-which will fetch snapshots built and signed by the author. If you want to
	-use these updates, copy that file to
	-
	- %%PREFIX%%/etc/portsnap.conf
	-
	-otherwise, create that file as appropriate.
	-EOM
	-}
	-{
	- type: upgrade
	- maximum_version: "0.3.2"
	- message: <<EOM
	-The structure of the portsnap configuration file has changed; you will
	-have to replace your existing portsnap.conf with a new version.
	-EOM
	-}
	-]
	diff --git a/ports-mgmt/portsnap/pkg-descr b/ports-mgmt/portsnap/pkg-descr
	deleted file mode 100644
	--- a/ports-mgmt/portsnap/pkg-descr
	+++ /dev/null
	@@ -1,13 +0,0 @@
	-Portsnap is a system for securely updating the ports tree by
	-distributing signed compressed snapshots. This is the client
	-half of that system; it downloads compressed snapshots into
	-/usr/local/portsnap ("portsnap fetch") and uses those to extract
	-a ports tree into /usr/ports ("portsnap extract") or update an
	-existing tree ("portsnap update").
	-
	-In addition to operating entirely over HTTP, portsnap can use under
	-a tenth of the bandwidth required by CVSup if a copy of the ports
	-tree is being updated every few days.
	-
	-- Colin Percival
	-cperciva@daemonology.net
	diff --git a/security/Makefile b/security/Makefile
	--- a/security/Makefile
	+++ b/security/Makefile
	@@ -282,7 +282,6 @@
	SUBDIR += krb5-122
	SUBDIR += krb5-devel
	SUBDIR += kstart
	- SUBDIR += ktls_isa-l_crypto-kmod
	SUBDIR += kuku
	SUBDIR += kwalletmanager
	SUBDIR += l0pht-watch
	@@ -456,7 +455,6 @@
	SUBDIR += openssl-oqsprovider
	SUBDIR += openssl-pkcs11provider
	SUBDIR += openssl-unsafe
	- SUBDIR += openssl111
	SUBDIR += openssl34
	SUBDIR += openssl35
	SUBDIR += openssl36
	diff --git a/security/cyrus-sasl2/Makefile b/security/cyrus-sasl2/Makefile
	--- a/security/cyrus-sasl2/Makefile
	+++ b/security/cyrus-sasl2/Makefile
	@@ -12,7 +12,6 @@
	OPTIONS_DEFINE= ALWAYSTRUE AUTHDAEMOND DOCS KEEP_DB_OPEN \
	OBSOLETE_CRAM_ATTR OBSOLETE_DIGEST_ATTR \
	OPIE SASLDB_IN_VAR
	-OPTIONS_EXCLUDE_FreeBSD_13= OPIE
	OPTIONS_RADIO= SASLDB
	OPTIONS_RADIO_SASLDB= BDB1 BDB GDBM LMDB
	OPTIONS_GROUP= PLUGIN
	diff --git a/security/cyrus-sasl2/Makefile.common b/security/cyrus-sasl2/Makefile.common
	--- a/security/cyrus-sasl2/Makefile.common
	+++ b/security/cyrus-sasl2/Makefile.common
	@@ -101,7 +101,7 @@
	SASLDB= "@comment "
	.endif

	-.if ${OPSYS} == FreeBSD && ${OSREL:R} >= 14
	+.if ${OPSYS} == FreeBSD
	.if ${PORT_OPTIONS:MOPIE} && ${PORT_OPTIONS:MOTP}
	CONFIGURE_ARGS+=--with-opie=${LOCALBASE}
	LIB_DEPENDS+= libopie.so:security/opie
	diff --git a/security/ftimes/Makefile b/security/ftimes/Makefile
	--- a/security/ftimes/Makefile
	+++ b/security/ftimes/Makefile
	@@ -12,7 +12,6 @@
	LICENSE_COMB= multi

	BROKEN_aarch64= fails to build: aarch64 is not currently supported
	-BROKEN_mips64= fails to build: mips64 is not currently supported
	BROKEN_riscv64= fails to build: riscv64 is not currently supported

	GNU_CONFIGURE= yes
	diff --git a/security/git-crypt/Makefile b/security/git-crypt/Makefile
	--- a/security/git-crypt/Makefile
	+++ b/security/git-crypt/Makefile
	@@ -38,7 +38,7 @@
	LDFLAGS+= -L${OPENSSLLIB}
	.endif

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CXXFLAGS+= -DOPENSSL_API_COMPAT=0x30000000L
	.endif

	diff --git a/security/gost-engine/Makefile b/security/gost-engine/Makefile
	--- a/security/gost-engine/Makefile
	+++ b/security/gost-engine/Makefile
	@@ -40,7 +40,7 @@
	.endif

	# For OpenSSL 3.0.x in base (14+) or installed as port/package
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 \|\| ${FLAVOR:U} == openssl30
	+.if ${OPSYS} == FreeBSD \|\| ${FLAVOR:U} == openssl30
	GH_TAGNAME= 2b22503
	GH_TUPLE+= provider-corner:libprov:e9f3e6a:libprov
	GH_SUBDIR= libprov:libprov
	diff --git a/security/helib/Makefile b/security/helib/Makefile
	--- a/security/helib/Makefile
	+++ b/security/helib/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= APACHE20
	LICENSE_FILE= ${WRKSRC}/LICENSE.md

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe

	LIB_DEPENDS= libgmp.so:math/gmp \
	libntl.so:math/ntl
	diff --git a/security/kanidm/Makefile b/security/kanidm/Makefile
	--- a/security/kanidm/Makefile
	+++ b/security/kanidm/Makefile
	@@ -13,7 +13,6 @@
	LICENSE= MPL20
	LICENSE_FILE= ${WRKSRC}/LICENSE.md

	-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
	ONLY_FOR_ARCHS= aarch64 amd64

	FLAVORS= client server
	diff --git a/security/ktls_isa-l_crypto-kmod/Makefile b/security/ktls_isa-l_crypto-kmod/Makefile
	deleted file mode 100644
	--- a/security/ktls_isa-l_crypto-kmod/Makefile
	+++ /dev/null
	@@ -1,43 +0,0 @@
	-PORTNAME= isa-l_crypto
	-PORTVERSION= 2.21.0
	-DISTVERSIONPREFIX= v
	-PORTREVISION= 1
	-CATEGORIES= security
	-PKGNAMEPREFIX= ktls_
	-PKGNAMESUFFIX= -kmod
	-
	-MAINTAINER= gallatin@FreeBSD.org
	-COMMENT= KTLS module using Intel(R) ISA-L crypto
	-WWW= https://github.com/01org/isa-l_crypto
	-
	-LICENSE= BSD3CLAUSE
	-LICENSE_FILE= ${WRKSRC}/LICENSE
	-
	-ONLY_FOR_ARCHS= amd64
	-
	-BUILD_DEPENDS= yasm:devel/yasm
	-
	-USES= kmod uidfix
	-
	-USE_GITHUB= yes
	-GH_ACCOUNT= 01org
	-
	-MAKE_ENV+= ISASRC=${WRKSRC}
	-
	-PLIST_FILES= ${KMODDIR}/ktls_intel-isa-l.ko
	-
	-.include <bsd.port.pre.mk>
	-
	-.if !exists(${SRC_BASE}/sys/sys/ktls.h)
	-IGNORE= requires KTLS support
	-.endif
	-
	-.if ${OSVERSION} >= 1400016
	-IGNORE= is only supported on FreeBSD 13
	-.endif
	-
	-post-extract:
	- ${CP} ${FILESDIR}/* ${WRKSRC}/
	- ${ECHO} "#include <sys/stdint.h>" > ${WRKSRC}/include/stdint.h
	-
	-.include <bsd.port.post.mk>
	diff --git a/security/ktls_isa-l_crypto-kmod/distinfo b/security/ktls_isa-l_crypto-kmod/distinfo
	deleted file mode 100644
	--- a/security/ktls_isa-l_crypto-kmod/distinfo
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-TIMESTAMP = 1566856170
	-SHA256 (01org-isa-l_crypto-v2.21.0_GH0.tar.gz) = 58284d7e5e60c37d6d4c1bbc2a876e95d14ca153443775a491f91c21a4243171
	-SIZE (01org-isa-l_crypto-v2.21.0_GH0.tar.gz) = 502413
	diff --git a/security/ktls_isa-l_crypto-kmod/files/Makefile b/security/ktls_isa-l_crypto-kmod/files/Makefile
	deleted file mode 100644
	--- a/security/ktls_isa-l_crypto-kmod/files/Makefile
	+++ /dev/null
	@@ -1,60 +0,0 @@
	-# Copyright (c) 2016-2019 Netflix, Inc
	-#
	-# Redistribution and use in source and binary forms, with or without
	-# modification, are permitted provided that the following conditions
	-# are met:
	-# 1. Redistributions of source code must retain the above copyright
	-# notice, this list of conditions and the following disclaimer,
	-# without modification.
	-# 2. Redistributions in binary form must reproduce at minimum a disclaimer
	-# similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
	-# redistribution must be conditioned upon including a substantially
	-# similar Disclaimer requirement for further binary redistribution.
	-#
	-# NO WARRANTY
	-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	-# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	-# LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
	-# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
	-# THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
	-# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	-# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	-# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
	-# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	-# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
	-# THE POSSIBILITY OF SUCH DAMAGES.
	-
	-ISAINC=${ISASRC}/include
	-ISAAES=${ISASRC}/aes
	-INCS=-I${ISAINC} -I${ISAAES}
	-CFLAGS+=${INCS}
	-YASM=${LOCALBASE}/bin/yasm
	-
	-.PATH: ${ISASRC}/aes
	-.SUFFIXES: .asm
	-.asm.o:
	- ${YASM} -g dwarf2 -f elf64 ${INCS} -o ${.TARGET} ${.IMPSRC}
	-
	-KMOD= ktls_intel-isa-l
	-SRCS= gcm128_avx_gen2.asm \
	- gcm128_avx_gen4.asm \
	- gcm128_sse.asm \
	- gcm256_avx_gen2.asm \
	- gcm256_avx_gen4.asm \
	- gcm256_sse.asm \
	- gcm_multibinary.asm \
	- gcm128_avx_gen2_nt.asm \
	- gcm128_avx_gen4_nt.asm \
	- gcm128_sse_nt.asm \
	- gcm256_avx_gen2_nt.asm \
	- gcm256_avx_gen4_nt.asm \
	- gcm256_sse_nt.asm \
	- gcm_multibinary_nt.asm \
	- keyexp_128.asm \
	- keyexp_192.asm \
	- keyexp_256.asm \
	- keyexp_multibinary.asm \
	- gcm_pre.c \
	- intelisa_kern.c
	-
	-.include <bsd.kmod.mk>
	diff --git a/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c b/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c
	deleted file mode 100644
	--- a/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c
	+++ /dev/null
	@@ -1,394 +0,0 @@
	-/*-
	- * SPDX-License-Identifier: BSD-2-Clause
	- *
	- * Copyright (c) 2014-2018 Netflix Inc.
	- * All rights reserved.
	- *
	- * Redistribution and use in source and binary forms, with or without
	- * modification, are permitted provided that the following conditions
	- * are met:
	- * 1. Redistributions of source code must retain the above copyright
	- * notice, this list of conditions and the following disclaimer.
	- * 2. Redistributions in binary form must reproduce the above copyright
	- * notice, this list of conditions and the following disclaimer in the
	- * documentation and/or other materials provided with the distribution.
	- *
	- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	- * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	- * SUCH DAMAGE.
	- *
	- *
	- */
	-#include <sys/cdefs.h>
	-
	-#include <sys/types.h>
	-#include <sys/param.h>
	-#include <sys/kernel.h>
	-#include <sys/ktls.h>
	-#include <sys/lock.h>
	-#include <sys/malloc.h>
	-#include <sys/mutex.h>
	-#include <sys/proc.h>
	-#include <sys/sockbuf.h>
	-#include <sys/filedesc.h>
	-#include <sys/sysctl.h>
	-#include <sys/counter.h>
	-#include <sys/uio.h>
	-#include <sys/module.h>
	-#include <opencrypto/xform.h>
	-#include <machine/fpu.h>
	-
	-#include "aes_gcm.h"
	-
	-#define KTLS_INTELISA_AEAD_TAGLEN 16
	-
	-struct isa_gcm_struct {
	- struct gcm_key_data key_data;
	- struct gcm_context_data ctx_data;
	- void (gcm_pre) (const void key, struct gcm_key_data ); / Done once per key */
	- void (gcm_init) (const struct gcm_key_data key_data,
	- struct gcm_context_data *context_data,
	- uint8_t *iv,
	- uint8_t const *aad,
	- uint64_t aad_len); /* Done at start of crypt */
	- void (gcm_upd) (const struct gcm_key_data key_data,
	- struct gcm_context_data *context_data,
	- uint8_t *out,
	- const uint8_t *in,
	- uint64_t len); /* With each block of data */
	- void (gcm_upd_nt) (const struct gcm_key_data key_data,
	- struct gcm_context_data *context_data,
	- uint8_t *out,
	- const uint8_t *in,
	- uint64_t len); /* With each block of data */
	- void (gcm_final) (const struct gcm_key_data key_data,
	- struct gcm_context_data *context_data,
	- uint8_t *tag,
	- uint64_t tag_len); /* Pulls out the tag */
	-};
	-
	-SYSCTL_DECL(_kern_ipc_tls);
	-
	-static int ktls_use_intel_isa_gcm = 1;
	-SYSCTL_INT(_kern_ipc_tls, OID_AUTO, isa_gcm, CTLFLAG_RW,
	- &ktls_use_intel_isa_gcm, 1,
	- "Should we use the Intel ISA GCM if available");
	-
	-SYSCTL_DECL(_kern_ipc_tls_stats);
	-
	-static counter_u64_t ktls_offload_isa_aead;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aead_crypts,
	- CTLFLAG_RD, &ktls_offload_isa_aead,
	- "Total number of Intel ISA TLS AEAD encrypts called");
	-
	-static counter_u64_t ktls_offload_isa_tls_13;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_tls_13_crypts,
	- CTLFLAG_RD, &ktls_offload_isa_tls_13,
	- "Total number of Intel ISA TLS 1.3 encrypts called");
	-
	-static counter_u64_t ktls_offload_isa_tls_12;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_tls_12_crypts,
	- CTLFLAG_RD, &ktls_offload_isa_tls_12,
	- "Total number of Intel ISA TLS 1.2 encrypts called");
	-
	-static counter_u64_t intelisa_unaligned_mem_b;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_unaligned_bytes,
	- CTLFLAG_RD, &intelisa_unaligned_mem_b,
	- "Byte cnt of intel isa unaligned");
	-
	-static counter_u64_t intelisa_aligned_mem_b;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aligned_bytes,
	- CTLFLAG_RD, &intelisa_aligned_mem_b,
	- "Byte cnt of intel isa aligned");
	-
	-static counter_u64_t intelisa_unaligned_mem;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_unaligned,
	- CTLFLAG_RD, &intelisa_unaligned_mem,
	- "Call cnt of intel isa unaligned");
	-
	-static counter_u64_t intelisa_aligned_mem;
	-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aligned,
	- CTLFLAG_RD, &intelisa_aligned_mem,
	- "Call cnt of intel isa aligned");
	-
	-static MALLOC_DEFINE(M_INTEL_ISA, "isal_tls", "Intel ISA-L TLS");
	-
	-static int
	-intel_isa_seal(struct isa_gcm_struct *isa,
	- struct iovec *outiov, int numiovs,
	- uint8_t * iv,
	- struct iovec *iniov,
	- uint8_t * ad, int adlen,
	- uint8_t * tagout, size_t *taglen,
	- bool tls_13, uint8_t tls_13_rtype)
	-{
	- int i;
	- bool nt = true;
	- bool misaligned_len, misaligned_start;
	- int fixup = 0;
	- uint8_t *in;
	- uint8_t *out;
	- uint64_t len;
	-
	- isa->gcm_init(&isa->key_data, &isa->ctx_data, iv, ad, (size_t)adlen);
	- for (i = 0; i < numiovs; i++) {
	- in = iniov[i].iov_base;
	- out = outiov[i].iov_base;
	- len = iniov[i].iov_len;
	-
	- misaligned_start = ((uintptr_t)in & 0xf) != 0;
	- misaligned_len = (len & 0xf) != 0;
	-
	- if (misaligned_start \|\| misaligned_len) {
	- /*
	- * Try to do as much of a page using
	- * non-temporals as we possibly can, and leave
	- * a ragged tail as a separate chunk.
	- */
	- if (nt && !misaligned_start && len > 0xf) {
	- len = len & ~0xf;
	- fixup = iniov[i].iov_len - len;
	- } else {
	- nt = false;
	- }
	- }
	-fixup_done:
	- if (nt) {
	- isa->gcm_upd_nt(&isa->key_data, &isa->ctx_data, out, in, len);
	- counter_u64_add(intelisa_aligned_mem, 1);
	- counter_u64_add(intelisa_aligned_mem_b, len);
	- } else {
	- isa->gcm_upd(&isa->key_data, &isa->ctx_data, out, in, len);
	- counter_u64_add(intelisa_unaligned_mem, 1);
	- counter_u64_add(intelisa_unaligned_mem_b, len);
	- }
	- if (fixup) {
	- in += len;
	- out += len;
	- len = fixup;
	- fixup = 0;
	- nt = false;
	- goto fixup_done;
	- }
	- }
	- if (tls_13) {
	- *tagout = tls_13_rtype;
	- isa->gcm_upd(&isa->key_data, &isa->ctx_data, tagout,
	- tagout, 1);
	- tagout += 1;
	- }
	- isa->gcm_final(&isa->key_data, &isa->ctx_data, tagout, *taglen);
	- return (0);
	-}
	-
	-static int
	-ktls_intelisa_aead_encrypt(struct ktls_session *tls,
	- const struct tls_record_layer hdr, uint8_t trailer, struct iovec *iniov,
	- struct iovec *outiov, int iovcnt, uint64_t seqno, uint8_t tls_rtype)
	-{
	- struct isa_gcm_struct *isa;
	- struct tls_aead_data ad;
	- struct tls_nonce_data nd;
	- size_t adlen, taglen;
	- uint8_t *adptr;
	- int ret;
	- uint16_t tls_comp_len;
	- bool tls_13;
	-
	- isa = (struct isa_gcm_struct *)tls->cipher;
	-
	- KASSERT(isa != NULL, ("Null cipher"));
	- counter_u64_add(ktls_offload_isa_aead, 1);
	- taglen = KTLS_INTELISA_AEAD_TAGLEN;
	-
	- /* Setup the nonce */
	- memcpy(&nd, tls->params.iv, tls->params.iv_len);
	-
	- /* Setup the associated data */
	- ad.seq = htobe64(seqno);
	- ad.type = hdr->tls_type;
	- ad.tls_vmajor = hdr->tls_vmajor;
	- ad.tls_vminor = hdr->tls_vminor;
	-
	- /* Version-specific nonce and AAD. */
	- if (tls->params.tls_vminor == TLS_MINOR_VER_THREE) {
	- tls_13 = true;
	- counter_u64_add(ktls_offload_isa_tls_13, 1);
	-
	- adlen = sizeof(ad) - sizeof(ad.seq);
	- adptr = &ad.type;
	- ad.tls_length = hdr->tls_length;
	-
	- /*
	- * RFC 8446 5.3: left pad the 64b seqno
	- * with 0s, and xor with the IV.
	- */
	- nd.seq ^= htobe64(seqno);
	- } else {
	- tls_13 = false;
	- counter_u64_add(ktls_offload_isa_tls_12, 1);
	-
	- tls_comp_len = ntohs(hdr->tls_length) -
	- (KTLS_INTELISA_AEAD_TAGLEN + sizeof(nd.seq));
	- adlen = sizeof(ad);
	- adptr = (uint8_t *)&ad;
	- ad.tls_length = htons(tls_comp_len);
	-
	- memcpy(&nd.seq, hdr + 1, sizeof(nd.seq));
	- }
	-
	- ret = intel_isa_seal(isa, outiov, iovcnt, (uint8_t *)&nd, iniov,
	- adptr, adlen, trailer, &taglen,
	- tls_13, tls_rtype);
	-
	- return(ret);
	-}
	-
	-
	-static int
	-ktls_intelisa_setup_cipher(struct isa_gcm_struct isa, uint8_t key)
	-{
	- struct fpu_kern_ctx *fpu_ctx;
	-
	- if (key == NULL) {
	- return (EINVAL);
	- }
	- fpu_ctx = fpu_kern_alloc_ctx(FPU_KERN_NOWAIT);
	- if (fpu_ctx == NULL) {
	- return (ENOMEM);
	- }
	- fpu_kern_enter(curthread, fpu_ctx, FPU_KERN_NORMAL);
	- isa->gcm_pre(key, &isa->key_data);
	- fpu_kern_leave(curthread, fpu_ctx);
	- fpu_kern_free_ctx(fpu_ctx);
	- return (0);
	-}
	-
	-static void
	-ktls_intelisa_free(struct ktls_session *tls)
	-{
	- struct isa_gcm_struct *isa;
	-
	- isa = tls->cipher;
	- explicit_bzero(isa, sizeof(*isa));
	- free(isa, M_INTEL_ISA);
	-}
	-
	-static int
	-#if KTLS_API_VERSION >= 7
	-ktls_intelisa_try(struct socket so, struct ktls_session tls, int direction)
	-#else
	-ktls_intelisa_try(struct socket so, struct ktls_session tls)
	-#endif
	-{
	- struct isa_gcm_struct *isa;
	- int error;
	-
	-#if KTLS_API_VERSION >= 7
	- if (direction != KTLS_TX)
	- return (EOPNOTSUPP);
	-#endif
	- if (ktls_use_intel_isa_gcm &&
	- tls->params.cipher_algorithm == CRYPTO_AES_NIST_GCM_16) {
	- isa = malloc(sizeof (*isa), M_INTEL_ISA, M_NOWAIT \| M_ZERO);
	- if (isa == NULL) {
	- return (ENOMEM);
	- }
	- switch (tls->params.cipher_key_len) {
	- case 16:
	- isa->gcm_pre = aes_gcm_pre_128;
	- isa->gcm_init = aes_gcm_init_128;
	- isa->gcm_upd = aes_gcm_enc_128_update;
	- isa->gcm_upd_nt = aes_gcm_enc_128_update_nt;
	- isa->gcm_final = aes_gcm_enc_128_finalize;
	- break;
	- case 32:
	- isa->gcm_pre = aes_gcm_pre_256;
	- isa->gcm_init = aes_gcm_init_256;
	- isa->gcm_upd = aes_gcm_enc_256_update;
	- isa->gcm_upd_nt = aes_gcm_enc_256_update_nt;
	- isa->gcm_final = aes_gcm_enc_256_finalize;
	- break;
	- default:
	- free(isa, M_INTEL_ISA);
	- return (EOPNOTSUPP);
	- }
	-
	- error = ktls_intelisa_setup_cipher(isa, tls->params.cipher_key);
	- if (error) {
	- free(isa, M_INTEL_ISA);
	- return (error);
	- }
	-
	- tls->cipher = isa;
	- tls->sw_encrypt = ktls_intelisa_aead_encrypt;
	- tls->free = ktls_intelisa_free;
	- return (0);
	- }
	- return (EOPNOTSUPP);
	-}
	-
	-struct ktls_crypto_backend intelisa_backend = {
	- .name = "Intel ISA-L",
	- .prio = 20,
	- .api_version = KTLS_API_VERSION,
	- .try = ktls_intelisa_try,
	-};
	-
	-static int
	-intelisa_init(void)
	-{
	- ktls_offload_isa_aead = counter_u64_alloc(M_WAITOK);
	- ktls_offload_isa_tls_12 = counter_u64_alloc(M_WAITOK);
	- ktls_offload_isa_tls_13 = counter_u64_alloc(M_WAITOK);
	- intelisa_aligned_mem = counter_u64_alloc(M_WAITOK);
	- intelisa_aligned_mem_b = counter_u64_alloc(M_WAITOK);
	- intelisa_unaligned_mem = counter_u64_alloc(M_WAITOK);
	- intelisa_unaligned_mem_b = counter_u64_alloc(M_WAITOK);
	- return (ktls_crypto_backend_register(&intelisa_backend));
	-}
	-
	-static int
	-intelisa_unload(void)
	-{
	- int error;
	-
	- error = ktls_crypto_backend_deregister(&intelisa_backend);
	- if (error)
	- return (error);
	- counter_u64_free(ktls_offload_isa_aead);
	- counter_u64_free(intelisa_aligned_mem);
	- counter_u64_free(intelisa_aligned_mem_b);
	- counter_u64_free(intelisa_unaligned_mem);
	- counter_u64_free(intelisa_unaligned_mem_b);
	- return (0);
	-}
	-
	-static int
	-intelisa_module_event_handler(module_t mod, int evt, void *arg)
	-{
	- switch (evt) {
	- case MOD_LOAD:
	- return (intelisa_init());
	- case MOD_UNLOAD:
	- return (intelisa_unload());
	- default:
	- return (EOPNOTSUPP);
	- }
	-}
	-
	-static moduledata_t intelisa_moduledata = {
	- "intelisa",
	- intelisa_module_event_handler,
	- NULL
	-};
	-
	-DECLARE_MODULE(intelisa, intelisa_moduledata, SI_SUB_PROTO_END, SI_ORDER_ANY);
	diff --git a/security/ktls_isa-l_crypto-kmod/pkg-descr b/security/ktls_isa-l_crypto-kmod/pkg-descr
	deleted file mode 100644
	--- a/security/ktls_isa-l_crypto-kmod/pkg-descr
	+++ /dev/null
	@@ -1,6 +0,0 @@
	-ISA-L crypto is a collection of optimized low-level functions targeting
	-cryptography applications.
	-
	-This port provides a software encryption module for in-kernel TLS
	-(KTLS) that uses routines in the ISA-L crypto library to encrypt TLS
	-records.
	diff --git a/security/libhijack/Makefile b/security/libhijack/Makefile
	--- a/security/libhijack/Makefile
	+++ b/security/libhijack/Makefile
	@@ -15,7 +15,6 @@
	ONLY_FOR_ARCHS= aarch64 amd64
	ONLY_FOR_ARCHS_REASON= not ported to other architectures
	BROKEN_aarch64= does not build, upstream is working on a fix (PR 283408)
	-BROKEN_FreeBSD_13= does not build, upstream is working on a fix (PR 283408)

	USE_GITLAB= yes
	GL_SITE= https://git.hardenedbsd.org
	diff --git a/security/libp11/Makefile b/security/libp11/Makefile
	--- a/security/libp11/Makefile
	+++ b/security/libp11/Makefile
	@@ -34,15 +34,6 @@
	--with-modulesdir=${PREFIX}/lib/ossl-modules \
	--enable-static-engine

	-.include <bsd.port.options.mk>
	-
	-.if ${SSL_DEFAULT} == "base" && ${OPSYS} == FreeBSD && ${OSREL:R} < 14
	-PLIST_SUB+= PROVIDERS="@comment "
	-.else
	-PLIST_SUB+= PROVIDERS=""
	-.endif
	-
	-
	INSTALL_TARGET= install-strip

	PORTDOCS= *
	diff --git a/security/libp11/pkg-plist b/security/libp11/pkg-plist
	--- a/security/libp11/pkg-plist
	+++ b/security/libp11/pkg-plist
	@@ -2,8 +2,8 @@
	include/p11_err.h
	lib/engines/libpkcs11.so
	lib/engines/pkcs11.so
	-%%PROVIDERS%%lib/ossl-modules/libpkcs11.so
	-%%PROVIDERS%%lib/ossl-modules/pkcs11prov.so
	+lib/ossl-modules/libpkcs11.so
	+lib/ossl-modules/pkcs11prov.so
	lib/libp11.a
	lib/libp11.so
	lib/libp11.so.3
	diff --git a/security/nettle/Makefile b/security/nettle/Makefile
	--- a/security/nettle/Makefile
	+++ b/security/nettle/Makefile
	@@ -36,11 +36,6 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH} == "mips64"
	-post-patch:
	- @${REINPLACE_CMD} -e 's\|__sgi\|__unix__\|' ${WRKSRC}/configure
	-.endif
	-
	post-install:
	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/lib*.so
	${INSTALL_DATA} ${WRKSRC}/nettle.info ${STAGEDIR}${PREFIX}/${INFO_PATH}/nettle.info
	diff --git a/security/nmap-devel/Makefile b/security/nmap-devel/Makefile
	--- a/security/nmap-devel/Makefile
	+++ b/security/nmap-devel/Makefile
	@@ -17,8 +17,6 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE
	LICENSE_PERMS= auto-accept dist-mirror pkg-mirror pkg-sell

	-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
	-
	LIB_DEPENDS= libpcre2-16.so:devel/pcre2

	.if !defined(MASTERDIR)
	diff --git a/security/openssl-oqsprovider/Makefile b/security/openssl-oqsprovider/Makefile
	--- a/security/openssl-oqsprovider/Makefile
	+++ b/security/openssl-oqsprovider/Makefile
	@@ -22,7 +22,7 @@

	CMAKE_ARGS= -DCMAKE_BUILD_TYPE=Debug\
	-DOPENSSL_ROOT_DIR=${OPENSSLBASE} \
	- -DCMAKE_PREFIX_PATH=${OPENSSL_PATH}
	+ -DCMAKE_PREFIX_PATH=${OPENSSL_PATH}

	SUB_FILES= oqsprovider.cnf pkg-message

	@@ -32,10 +32,6 @@

	.include <bsd.port.pre.mk>

	-.if !defined(OPENSSL_PORT) && ${OSVERSION} < 1400000
	-BROKEN= Requires OpenSSL 3.0+, preferably 3.2+
	-.endif
	-
	post-install:
	.if ${OPENSSLLIB} == "/usr/lib"
	${MKDIR} ${STAGEDIR}${PREFIX}/lib/ossl-modules
	diff --git a/security/openssl-unsafe/Makefile b/security/openssl-unsafe/Makefile
	--- a/security/openssl-unsafe/Makefile
	+++ b/security/openssl-unsafe/Makefile
	@@ -31,7 +31,7 @@
	SUB_FILES= pkg-message
	PLIST_SUB+= SHLIBVER=${OPENSSL_SHLIBVER}

	-.if ${MACHINE_ARCH} == "amd64" \|\| ${MACHINE_ARCH} == "mips64el"
	+.if ${MACHINE_ARCH} == "amd64"
	CONFIGURE_ARGS+= enable-ec_nistp_64_gcc_128
	.endif

	diff --git a/security/openssl/Makefile b/security/openssl/Makefile
	--- a/security/openssl/Makefile
	+++ b/security/openssl/Makefile
	@@ -45,8 +45,6 @@

	.if ${MACHINE_ARCH} == "amd64"
	OPTIONS_GROUP_OPTIMIZE+= EC
	-.elif ${MACHINE_ARCH} == "mips64el"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	.endif

	OPTIONS_SUB= yes
	diff --git a/security/openssl111/Makefile b/security/openssl111/Makefile
	deleted file mode 100644
	--- a/security/openssl111/Makefile
	+++ /dev/null
	@@ -1,161 +0,0 @@
	-PORTNAME= openssl
	-PORTVERSION= 1.1.1w
	-PORTREVISION= 2
	-CATEGORIES= security devel
	-MASTER_SITES= https://www.openssl.org/source/ \
	- ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/
	-PKGNAMESUFFIX= 111
	-
	-MAINTAINER= brnrd@FreeBSD.org
	-COMMENT= TLSv1.3 capable SSL and crypto library
	-WWW= https://www.openssl.org/
	-
	-LICENSE= OpenSSL
	-LICENSE_FILE= ${WRKSRC}/LICENSE
	-
	-DEPRECATED= End-of-life since 2023-09-11, see https://www.openssl.org/blog/blog/2023/09/11/eol-111/ \
	- port will be removed when FreeBSD 13 is EoL
	-EXPIRATION_DATE= 2026-04-30
	-
	-CONFLICTS_INSTALL= boringssl libressl libressl-devel openssl openssl[34]*
	-
	-USES= cpe perl5
	-USE_PERL5= build
	-TEST_TARGET= test
	-
	-HAS_CONFIGURE= yes
	-CONFIGURE_SCRIPT= config
	-CONFIGURE_ENV= PERL="${PERL}"
	-CONFIGURE_ARGS= --openssldir=${OPENSSLDIR} \
	- --prefix=${PREFIX}
	-
	-LDFLAGS_i386= -Wl,-znotext
	-
	-MAKE_ARGS+= WHOLE_ARCHIVE_FLAG=--whole-archive CNF_LDFLAGS="${LDFLAGS}"
	-MAKE_ENV+= LIBRPATH="${PREFIX}/lib" GREP_OPTIONS=
	-
	-OPTIONS_GROUP= CIPHERS HASHES OPTIMIZE PROTOCOLS
	-OPTIONS_GROUP_CIPHERS= ARIA DES GOST IDEA SM4 RC2 RC4 RC5 WEAK-SSL-CIPHERS
	-OPTIONS_GROUP_HASHES= MD2 MD4 MDC2 RMD160 SM2 SM3
	-OPTIONS_GROUP_OPTIMIZE= ASM SSE2 THREADS
	-OPTIONS_DEFINE_i386= I386
	-OPTIONS_GROUP_PROTOCOLS=NEXTPROTONEG SCTP SSL3 TLS1 TLS1_1 TLS1_2
	-
	-OPTIONS_DEFINE= ASYNC CT KTLS MAN3 RFC3779 SHARED ZLIB
	-
	-OPTIONS_DEFAULT=ASM ASYNC CT GOST DES EC KTLS MAN3 MD4 NEXTPROTONEG RC2 \
	- RC4 RMD160 SCTP SHARED SSE2 THREADS TLS1 TLS1_1 TLS1_2
	-
	-.if ${MACHINE_ARCH} == "amd64"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	-.elif ${MACHINE_ARCH} == "mips64el"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	-.endif
	-
	-OPTIONS_SUB= yes
	-
	-ARIA_DESC= ARIA (South Korean standard)
	-ASM_DESC= Assembler code
	-ASYNC_DESC= Asynchronous mode
	-CIPHERS_DESC= Block Cipher Support
	-CT_DESC= Certificate Transparency Support
	-DES_DESC= (Triple) Data Encryption Standard
	-EC_DESC= Optimize NIST elliptic curves
	-GOST_DESC= GOST (Russian standard)
	-HASHES_DESC= Hash Function Support
	-I386_DESC= i386 (instead of i486+)
	-IDEA_DESC= International Data Encryption Algorithm
	-KTLS_DESC= Kernel TLS offload
	-MAN3_DESC= Install API manpages (section 3, 7)
	-MD2_DESC= MD2 (obsolete)
	-MD4_DESC= MD4 (unsafe)
	-MDC2_DESC= MDC-2 (patented, requires DES)
	-NEXTPROTONEG_DESC= Next Protocol Negotiation (SPDY)
	-OPTIMIZE_DESC= Optimizations
	-PROTOCOLS_DESC= Protocol Support
	-RC2_DESC= RC2 (unsafe)
	-RC4_DESC= RC4 (unsafe)
	-RC5_DESC= RC5 (patented)
	-RMD160_DESC= RIPEMD-160
	-RFC3779_DESC= RFC3779 support (BGP)
	-SCTP_DESC= SCTP (Stream Control Transmission)
	-SHARED_DESC= Build shared libraries
	-SM2_DESC= SM2 Elliptic Curve DH (Chinese standard)
	-SM3_DESC= SM3 256bit (Chinese standard)
	-SM4_DESC= SM4 128bit (Chinese standard)
	-SSE2_DESC= Runtime SSE2 detection
	-SSL3_DESC= SSLv3 (unsafe)
	-TLS1_DESC= TLSv1.0 (requires TLS1_1, TLS1_2)
	-TLS1_1_DESC= TLSv1.1 (requires TLS1_2)
	-TLS1_2_DESC= TLSv1.2
	-WEAK-SSL-CIPHERS_DESC= Weak cipher support (unsafe)
	-
	-# Upstream default disabled options
	-.for _option in ktls md2 rc5 sctp ssl3 zlib weak-ssl-ciphers
	-${_option:tu}_CONFIGURE_ON= enable-${_option}
	-.endfor
	-
	-# Upstream default enabled options
	-.for _option in aria asm async ct des gost idea md4 mdc2 nextprotoneg rc2 rc4 \
	- rfc3779 rmd160 shared sm2 sm3 sm4 sse2 threads tls1 tls1_1 tls1_2
	-${_option:tu}_CONFIGURE_OFF= no-${_option}
	-.endfor
	-
	-MDC2_IMPLIES= DES
	-TLS1_IMPLIES= TLS1_1
	-TLS1_1_IMPLIES= TLS1_2
	-
	-EC_CONFIGURE_ON= enable-ec_nistp_64_gcc_128
	-I386_CONFIGURE_ON= 386
	-KTLS_EXTRA_PATCHES= ${FILESDIR}/extra-patch-ktls
	-MAN3_EXTRA_PATCHES_OFF= ${FILESDIR}/extra-patch-util_process__docs.pl
	-SHARED_MAKE_ENV= SHLIBVER=${OPENSSL_SHLIBVER}
	-SHARED_PLIST_SUB= SHLIBVER=${OPENSSL_SHLIBVER}
	-SHARED_USE= ldconfig=yes
	-SSL3_CONFIGURE_ON+= enable-ssl3-method
	-ZLIB_CONFIGURE_ON= zlib-dynamic
	-
	-PORTSCOUT= limit:^1\.1\.1
	-
	-.include <bsd.port.pre.mk>
	-.if ${PREFIX} == /usr
	-IGNORE= the OpenSSL port can not be installed over the base version
	-.endif
	-
	-OPENSSLDIR?= ${PREFIX}/openssl
	-PLIST_SUB+= OPENSSLDIR=${OPENSSLDIR:S=^${PREFIX}/==}
	-
	-.include "version.mk"
	-
	-post-patch:
	- ${REINPLACE_CMD} \
	- -e 's\| install_html_docs$$\|\|' \
	- -e 's\|$$(LIBDIR)/pkgconfig\|libdata/pkgconfig\|g' \
	- ${WRKSRC}/Configurations/unix-Makefile.tmpl
	- ${REINPLACE_CMD} -e 's\|\^GNU ld\|GNU\|' ${WRKSRC}/Configurations/shared-info.pl
	-
	-post-configure:
	- ${REINPLACE_CMD} \
	- -e 's\|SHLIB_VERSION_NUMBER=1.1\|SHLIB_VERSION_NUMBER=${OPENSSL_SHLIBVER}\|' \
	- ${WRKSRC}/Makefile
	- ${REINPLACE_CMD} \
	- -e 's\|SHLIB_VERSION_NUMBER "1.1"\|SHLIB_VERSION_NUMBER "${OPENSSL_SHLIBVER}"\|' \
	- ${WRKSRC}/include/openssl/opensslv.h
	-
	-post-install-SHARED-on:
	-.for i in libcrypto libssl
	- ${INSTALL_LIB} ${WRKSRC}/$i.so.${OPENSSL_SHLIBVER} ${STAGEDIR}${PREFIX}/lib
	- ${LN} -sf $i.so.${OPENSSL_SHLIBVER} ${STAGEDIR}${PREFIX}/lib/$i.so
	-.endfor
	-.for i in capi padlock
	- ${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/engines-1.1/${i}.so
	-.endfor
	-
	-post-install:
	- ${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/openssl
	-
	-post-install-MAN3-on:
	- ( cd ${STAGEDIR}/${PREFIX} ; ${FIND} share/man/man3 share/man/man7 -not -type d ) \| \
	- ${SED} 's/$$/.gz/' >>${TMPPLIST}
	-
	-.include <bsd.port.post.mk>
	diff --git a/security/openssl111/distinfo b/security/openssl111/distinfo
	deleted file mode 100644
	--- a/security/openssl111/distinfo
	+++ /dev/null
	@@ -1,3 +0,0 @@
	-TIMESTAMP = 1694449777
	-SHA256 (openssl-1.1.1w.tar.gz) = cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8
	-SIZE (openssl-1.1.1w.tar.gz) = 9893384
	diff --git a/security/openssl111/files/extra-patch-ktls b/security/openssl111/files/extra-patch-ktls
	deleted file mode 100644
	--- a/security/openssl111/files/extra-patch-ktls
	+++ /dev/null
	@@ -1,3435 +0,0 @@
	-diff --git CHANGES CHANGES
	-index a5522e5fa5..98961effc0 100644
	---- CHANGES
	-+++ CHANGES
	-@@ -606,6 +606,11 @@
	- necessary to configure just to create a source distribution.
	- [Richard Levitte]
	-
	-+ *) Added support for Linux Kernel TLS data-path. The Linux Kernel data-path
	-+ improves application performance by removing data copies and providing
	-+ applications with zero-copy system calls such as sendfile and splice.
	-+ [Boris Pismenny]
	-+
	- Changes between 1.1.1 and 1.1.1a [20 Nov 2018]
	-
	- *) Timing vulnerability in DSA signature generation
	-diff --git Configure Configure
	-index 4bea49d7da..e656814a7f 100755
	---- Configure
	-+++ Configure
	-@@ -341,6 +341,7 @@ my @dtls = qw(dtls1 dtls1_2);
	- # For developers: keep it sorted alphabetically
	-
	- my @disablables = (
	-+ "ktls",
	- "afalgeng",
	- "aria",
	- "asan",
	-@@ -474,6 +475,7 @@ our %disabled = ( # "what" => "comment"
	- "weak-ssl-ciphers" => "default",
	- "zlib" => "default",
	- "zlib-dynamic" => "default",
	-+ "ktls" => "default",
	- );
	-
	- # Note: => pair form used for aesthetics, not to truly make a hash table
	-@@ -1583,6 +1585,33 @@ unless ($disabled{devcryptoeng}) {
	- }
	- }
	-
	-+unless ($disabled{ktls}) {
	-+ $config{ktls}="";
	-+ if ($target =~ m/^linux/) {
	-+ my $usr = "/usr/$config{cross_compile_prefix}";
	-+ chop($usr);
	-+ if ($config{cross_compile_prefix} eq "") {
	-+ $usr = "/usr";
	-+ }
	-+ my $minver = (4 << 16) + (13 << 8) + 0;
	-+ my @verstr = split(" ",`cat $usr/include/linux/version.h \| grep LINUX_VERSION_CODE`);
	-+
	-+ if ($verstr[2] < $minver) {
	-+ disable('too-old-kernel', 'ktls');
	-+ }
	-+ } elsif ($target =~ m/^BSD/) {
	-+ my $cc = $config{CROSS_COMPILE}.$config{CC};
	-+ system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' \| $cc -E - >/dev/null 2>&1");
	-+ if ($? != 0) {
	-+ disable('too-old-freebsd', 'ktls');
	-+ }
	-+ } else {
	-+ disable('not-linux-or-freebsd', 'ktls');
	-+ }
	-+}
	-+
	-+push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
	-+
	- # Get the extra flags used when building shared libraries and modules. We
	- # do this late because some of them depend on %disabled.
	-
	-diff --git INSTALL INSTALL
	-index f3ac727183..f6f754fd5e 100644
	---- INSTALL
	-+++ INSTALL
	-@@ -263,6 +263,15 @@
	- Don't build the AFALG engine. This option will be forced if
	- on a platform that does not support AFALG.
	-
	-+ enable-ktls
	-+ Build with Kernel TLS support. This option will enable the
	-+ use of the Kernel TLS data-path, which can improve
	-+ performance and allow for the use of sendfile and splice
	-+ system calls on TLS sockets. The Kernel may use TLS
	-+ accelerators if any are available on the system.
	-+ This option will be forced off on systems that do not support
	-+ the Kernel TLS data-path.
	-+
	- enable-asan
	- Build with the Address sanitiser. This is a developer option
	- only. It may not work on all platforms and should never be
	-diff --git apps/s_client.c apps/s_client.c
	-index 00effc8037..5664e7e04e 100644
	---- apps/s_client.c
	-+++ apps/s_client.c
	-@@ -3295,6 +3295,12 @@ static void print_stuff(BIO bio, SSL s, int full)
	- BIO_printf(bio, "Expansion: %s\n",
	- expansion ? SSL_COMP_get_name(expansion) : "NONE");
	- #endif
	-+#ifndef OPENSSL_NO_KTLS
	-+ if (BIO_get_ktls_send(SSL_get_wbio(s)))
	-+ BIO_printf(bio_err, "Using Kernel TLS for sending\n");
	-+ if (BIO_get_ktls_recv(SSL_get_rbio(s)))
	-+ BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
	-+#endif
	-
	- #ifdef SSL_DEBUG
	- {
	-diff --git apps/s_server.c apps/s_server.c
	-index 64d53e68d0..9fcb8d7a7b 100644
	---- apps/s_server.c
	-+++ apps/s_server.c
	-@@ -2934,6 +2934,12 @@ static void print_connection_info(SSL *con)
	- }
	- OPENSSL_free(exportedkeymat);
	- }
	-+#ifndef OPENSSL_NO_KTLS
	-+ if (BIO_get_ktls_send(SSL_get_wbio(con)))
	-+ BIO_printf(bio_err, "Using Kernel TLS for sending\n");
	-+ if (BIO_get_ktls_recv(SSL_get_rbio(con)))
	-+ BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
	-+#endif
	-
	- (void)BIO_flush(bio_s_out);
	- }
	-diff --git crypto/bio/b_sock2.c crypto/bio/b_sock2.c
	-index 104ff31b0d..771729880e 100644
	---- crypto/bio/b_sock2.c
	-+++ crypto/bio/b_sock2.c
	-@@ -12,6 +12,7 @@
	- #include <errno.h>
	-
	- #include "bio_local.h"
	-+#include "internal/ktls.h"
	-
	- #include <openssl/err.h>
	-
	-@@ -50,6 +51,17 @@ int BIO_socket(int domain, int socktype, int protocol, int options)
	- BIOerr(BIO_F_BIO_SOCKET, BIO_R_UNABLE_TO_CREATE_SOCKET);
	- return INVALID_SOCKET;
	- }
	-+# ifndef OPENSSL_NO_KTLS
	-+ {
	-+ /*
	-+ * The new socket is created successfully regardless of ktls_enable.
	-+ * ktls_enable doesn't change any functionality of the socket, except
	-+ * changing the setsockopt to enable the processing of ktls_start.
	-+ * Thus, it is not a problem to call it for non-TLS sockets.
	-+ */
	-+ ktls_enable(sock);
	-+ }
	-+# endif
	-
	- return sock;
	- }
	-diff --git crypto/bio/bss_conn.c crypto/bio/bss_conn.c
	-index 807a82b23b..10cf20871c 100644
	---- crypto/bio/bss_conn.c
	-+++ crypto/bio/bss_conn.c
	-@@ -11,6 +11,7 @@
	- #include <errno.h>
	-
	- #include "bio_local.h"
	-+#include "internal/ktls.h"
	-
	- #ifndef OPENSSL_NO_SOCK
	-
	-@@ -20,6 +21,9 @@ typedef struct bio_connect_st {
	- char *param_hostname;
	- char *param_service;
	- int connect_mode;
	-+# ifndef OPENSSL_NO_KTLS
	-+ unsigned char record_type;
	-+# endif
	-
	- BIO_ADDRINFO *addr_first;
	- const BIO_ADDRINFO *addr_iter;
	-@@ -320,7 +324,12 @@ static int conn_read(BIO b, char out, int outl)
	-
	- if (out != NULL) {
	- clear_socket_error();
	-- ret = readsocket(b->num, out, outl);
	-+# ifndef OPENSSL_NO_KTLS
	-+ if (BIO_get_ktls_recv(b))
	-+ ret = ktls_read_record(b->num, out, outl);
	-+ else
	-+# endif
	-+ ret = readsocket(b->num, out, outl);
	- BIO_clear_retry_flags(b);
	- if (ret <= 0) {
	- if (BIO_sock_should_retry(ret))
	-@@ -345,7 +354,16 @@ static int conn_write(BIO b, const char in, int inl)
	- }
	-
	- clear_socket_error();
	-- ret = writesocket(b->num, in, inl);
	-+# ifndef OPENSSL_NO_KTLS
	-+ if (BIO_should_ktls_ctrl_msg_flag(b)) {
	-+ ret = ktls_send_ctrl_message(b->num, data->record_type, in, inl);
	-+ if (ret >= 0) {
	-+ ret = inl;
	-+ BIO_clear_ktls_ctrl_msg_flag(b);
	-+ }
	-+ } else
	-+# endif
	-+ ret = writesocket(b->num, in, inl);
	- BIO_clear_retry_flags(b);
	- if (ret <= 0) {
	- if (BIO_sock_should_retry(ret))
	-@@ -361,6 +379,9 @@ static long conn_ctrl(BIO b, int cmd, long num, void ptr)
	- const char **pptr = NULL;
	- long ret = 1;
	- BIO_CONNECT *data;
	-+# ifndef OPENSSL_NO_KTLS
	-+ ktls_crypto_info_t *crypto_info;
	-+# endif
	-
	- data = (BIO_CONNECT *)b->ptr;
	-
	-@@ -518,8 +539,29 @@ static long conn_ctrl(BIO b, int cmd, long num, void ptr)
	- }
	- break;
	- case BIO_CTRL_EOF:
	-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
	-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
	- break;
	-+# ifndef OPENSSL_NO_KTLS
	-+ case BIO_CTRL_SET_KTLS:
	-+ crypto_info = (ktls_crypto_info_t *)ptr;
	-+ ret = ktls_start(b->num, crypto_info, num);
	-+ if (ret)
	-+ BIO_set_ktls_flag(b, num);
	-+ break;
	-+ case BIO_CTRL_GET_KTLS_SEND:
	-+ return BIO_should_ktls_flag(b, 1) != 0;
	-+ case BIO_CTRL_GET_KTLS_RECV:
	-+ return BIO_should_ktls_flag(b, 0) != 0;
	-+ case BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG:
	-+ BIO_set_ktls_ctrl_msg_flag(b);
	-+ data->record_type = num;
	-+ ret = 0;
	-+ break;
	-+ case BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG:
	-+ BIO_clear_ktls_ctrl_msg_flag(b);
	-+ ret = 0;
	-+ break;
	-+# endif
	- default:
	- ret = 0;
	- break;
	-diff --git crypto/bio/bss_fd.c crypto/bio/bss_fd.c
	-index ccbe1626ba..8d03e48ce9 100644
	---- crypto/bio/bss_fd.c
	-+++ crypto/bio/bss_fd.c
	-@@ -189,7 +189,7 @@ static long fd_ctrl(BIO b, int cmd, long num, void ptr)
	- ret = 1;
	- break;
	- case BIO_CTRL_EOF:
	-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
	-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
	- break;
	- default:
	- ret = 0;
	-diff --git crypto/bio/bss_sock.c crypto/bio/bss_sock.c
	-index 6251f3d46a..8de1f58292 100644
	---- crypto/bio/bss_sock.c
	-+++ crypto/bio/bss_sock.c
	-@@ -11,6 +11,7 @@
	- #include <errno.h>
	- #include "bio_local.h"
	- #include "internal/cryptlib.h"
	-+#include "internal/ktls.h"
	-
	- #ifndef OPENSSL_NO_SOCK
	-
	-@@ -64,6 +65,17 @@ BIO *BIO_new_socket(int fd, int close_flag)
	- if (ret == NULL)
	- return NULL;
	- BIO_set_fd(ret, fd, close_flag);
	-+# ifndef OPENSSL_NO_KTLS
	-+ {
	-+ /*
	-+ * The new socket is created successfully regardless of ktls_enable.
	-+ * ktls_enable doesn't change any functionality of the socket, except
	-+ * changing the setsockopt to enable the processing of ktls_start.
	-+ * Thus, it is not a problem to call it for non-TLS sockets.
	-+ */
	-+ ktls_enable(fd);
	-+ }
	-+# endif
	- return ret;
	- }
	-
	-@@ -96,7 +108,12 @@ static int sock_read(BIO b, char out, int outl)
	-
	- if (out != NULL) {
	- clear_socket_error();
	-- ret = readsocket(b->num, out, outl);
	-+# ifndef OPENSSL_NO_KTLS
	-+ if (BIO_get_ktls_recv(b))
	-+ ret = ktls_read_record(b->num, out, outl);
	-+ else
	-+# endif
	-+ ret = readsocket(b->num, out, outl);
	- BIO_clear_retry_flags(b);
	- if (ret <= 0) {
	- if (BIO_sock_should_retry(ret))
	-@@ -110,10 +127,20 @@ static int sock_read(BIO b, char out, int outl)
	-
	- static int sock_write(BIO b, const char in, int inl)
	- {
	-- int ret;
	-+ int ret = 0;
	-
	- clear_socket_error();
	-- ret = writesocket(b->num, in, inl);
	-+# ifndef OPENSSL_NO_KTLS
	-+ if (BIO_should_ktls_ctrl_msg_flag(b)) {
	-+ unsigned char record_type = (intptr_t)b->ptr;
	-+ ret = ktls_send_ctrl_message(b->num, record_type, in, inl);
	-+ if (ret >= 0) {
	-+ ret = inl;
	-+ BIO_clear_ktls_ctrl_msg_flag(b);
	-+ }
	-+ } else
	-+# endif
	-+ ret = writesocket(b->num, in, inl);
	- BIO_clear_retry_flags(b);
	- if (ret <= 0) {
	- if (BIO_sock_should_retry(ret))
	-@@ -126,6 +153,9 @@ static long sock_ctrl(BIO b, int cmd, long num, void ptr)
	- {
	- long ret = 1;
	- int *ip;
	-+# ifndef OPENSSL_NO_KTLS
	-+ ktls_crypto_info_t *crypto_info;
	-+# endif
	-
	- switch (cmd) {
	- case BIO_C_SET_FD:
	-@@ -153,8 +183,29 @@ static long sock_ctrl(BIO b, int cmd, long num, void ptr)
	- case BIO_CTRL_FLUSH:
	- ret = 1;
	- break;
	-+# ifndef OPENSSL_NO_KTLS
	-+ case BIO_CTRL_SET_KTLS:
	-+ crypto_info = (ktls_crypto_info_t *)ptr;
	-+ ret = ktls_start(b->num, crypto_info, num);
	-+ if (ret)
	-+ BIO_set_ktls_flag(b, num);
	-+ break;
	-+ case BIO_CTRL_GET_KTLS_SEND:
	-+ return BIO_should_ktls_flag(b, 1) != 0;
	-+ case BIO_CTRL_GET_KTLS_RECV:
	-+ return BIO_should_ktls_flag(b, 0) != 0;
	-+ case BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG:
	-+ BIO_set_ktls_ctrl_msg_flag(b);
	-+ b->ptr = (void *)num;
	-+ ret = 0;
	-+ break;
	-+ case BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG:
	-+ BIO_clear_ktls_ctrl_msg_flag(b);
	-+ ret = 0;
	-+ break;
	-+# endif
	- case BIO_CTRL_EOF:
	-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
	-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
	- break;
	- default:
	- ret = 0;
	-diff --git crypto/err/openssl.txt crypto/err/openssl.txt
	-index 902e97b843..846c896359 100644
	---- crypto/err/openssl.txt
	-+++ crypto/err/openssl.txt
	-@@ -1319,6 +1319,7 @@ SSL_F_SSL_RENEGOTIATE:516:SSL_renegotiate
	- SSL_F_SSL_RENEGOTIATE_ABBREVIATED:546:SSL_renegotiate_abbreviated
	- SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT:320:*
	- SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT:321:*
	-+SSL_F_SSL_SENDFILE:639:SSL_sendfile
	- SSL_F_SSL_SESSION_DUP:348:ssl_session_dup
	- SSL_F_SSL_SESSION_NEW:189:SSL_SESSION_new
	- SSL_F_SSL_SESSION_PRINT_FP:190:SSL_SESSION_print_fp
	-diff --git crypto/evp/e_aes.c crypto/evp/e_aes.c
	-index a1d3ab90fa..715fac9f88 100644
	---- crypto/evp/e_aes.c
	-+++ crypto/evp/e_aes.c
	-@@ -2889,6 +2889,14 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX c, int type, int arg, void ptr)
	- memcpy(ptr, c->buf, arg);
	- return 1;
	-
	-+ case EVP_CTRL_GET_IV:
	-+ if (gctx->iv_gen != 1)
	-+ return 0;
	-+ if (gctx->ivlen != arg)
	-+ return 0;
	-+ memcpy(ptr, gctx->iv, arg);
	-+ return 1;
	-+
	- case EVP_CTRL_GCM_SET_IV_FIXED:
	- /* Special case: -1 length restores whole IV */
	- if (arg == -1) {
	-diff --git doc/man3/BIO_ctrl.pod doc/man3/BIO_ctrl.pod
	-index cf6ba135df..fc51173c8d 100644
	---- doc/man3/BIO_ctrl.pod
	-+++ doc/man3/BIO_ctrl.pod
	-@@ -5,7 +5,8 @@
	- BIO_ctrl, BIO_callback_ctrl, BIO_ptr_ctrl, BIO_int_ctrl, BIO_reset,
	- BIO_seek, BIO_tell, BIO_flush, BIO_eof, BIO_set_close, BIO_get_close,
	- BIO_pending, BIO_wpending, BIO_ctrl_pending, BIO_ctrl_wpending,
	--BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb
	-+BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb, BIO_get_ktls_send,
	-+BIO_get_ktls_recv
	- - BIO control operations
	-
	- =head1 SYNOPSIS
	-@@ -34,6 +35,9 @@ BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb
	- int BIO_get_info_callback(BIO b, BIO_info_cb *cbp);
	- int BIO_set_info_callback(BIO b, BIO_info_cb cb);
	-
	-+ int BIO_get_ktls_send(BIO *b);
	-+ int BIO_get_ktls_recv(BIO *b);
	-+
	- =head1 DESCRIPTION
	-
	- BIO_ctrl(), BIO_callback_ctrl(), BIO_ptr_ctrl() and BIO_int_ctrl()
	-@@ -72,6 +76,11 @@ Not all BIOs support these calls. BIO_ctrl_pending() and BIO_ctrl_wpending()
	- return a size_t type and are functions, BIO_pending() and BIO_wpending() are
	- macros which call BIO_ctrl().
	-
	-+BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for
	-+sending. Otherwise, it returns zero.
	-+BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for
	-+receiving. Otherwise, it returns zero.
	-+
	- =head1 RETURN VALUES
	-
	- BIO_reset() normally returns 1 for success and 0 or -1 for failure. File
	-@@ -92,6 +101,11 @@ BIO_get_close() returns the close flag value: BIO_CLOSE or BIO_NOCLOSE.
	- BIO_pending(), BIO_ctrl_pending(), BIO_wpending() and BIO_ctrl_wpending()
	- return the amount of pending data.
	-
	-+BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for
	-+sending. Otherwise, it returns zero.
	-+BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for
	-+receiving. Otherwise, it returns zero.
	-+
	- =head1 NOTES
	-
	- BIO_flush(), because it can write data may return 0 or -1 indicating
	-@@ -124,6 +138,11 @@ particular a return value of 0 can be returned if an operation is not
	- supported, if an error occurred, if EOF has not been reached and in
	- the case of BIO_seek() on a file BIO for a successful operation.
	-
	-+=head1 HISTORY
	-+
	-+The BIO_get_ktls_send() and BIO_get_ktls_recv() functions were added in
	-+OpenSSL 3.0.0.
	-+
	- =head1 COPYRIGHT
	-
	- Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
	-diff --git doc/man3/SSL_CONF_cmd.pod doc/man3/SSL_CONF_cmd.pod
	-index 7f0e088687..c7cce5486b 100644
	---- doc/man3/SSL_CONF_cmd.pod
	-+++ doc/man3/SSL_CONF_cmd.pod
	-@@ -495,6 +495,10 @@ specification. Some applications may be able to mitigate the replay risks in
	- other ways and in such cases the built-in OpenSSL functionality is not required.
	- Disabling anti-replay is equivalent to setting B<SSL_OP_NO_ANTI_REPLAY>.
	-
	-+B<KTLS>: Enables kernel TLS if support has been compiled in, and it is supported
	-+by the negotiated ciphersuites and extensions. Equivalent to
	-+B<SSL_OP_ENABLE_KTLS>.
	-+
	- =item B<VerifyMode>
	-
	- The B<value> argument is a comma separated list of flags to set.
	-diff --git doc/man3/SSL_CTX_set_options.pod doc/man3/SSL_CTX_set_options.pod
	-index 969e0366c4..231fe92d8e 100644
	---- doc/man3/SSL_CTX_set_options.pod
	-+++ doc/man3/SSL_CTX_set_options.pod
	-@@ -237,6 +237,29 @@ functionality is not required. Those applications can turn this feature off by
	- setting this option. This is a server-side opton only. It is ignored by
	- clients.
	-
	-+=item SSL_OP_ENABLE_KTLS
	-+
	-+Enable the use of kernel TLS. In order to benefit from kernel TLS OpenSSL must
	-+have been compiled with support for it, and it must be supported by the
	-+negotiated ciphersuites and extensions. The specific ciphersuites and extensions
	-+that are supported may vary by platform and kernel version.
	-+
	-+The kernel TLS data-path implements the record layer, and the encryption
	-+algorithm. The kernel will utilize the best hardware
	-+available for encryption. Using the kernel data-path should reduce the memory
	-+footprint of OpenSSL because no buffering is required. Also, the throughput
	-+should improve because data copy is avoided when user data is encrypted into
	-+kernel memory instead of the usual encrypt then copy to kernel.
	-+
	-+Kernel TLS might not support all the features of OpenSSL. For instance,
	-+renegotiation, and setting the maximum fragment size is not possible as of
	-+Linux 4.20.
	-+
	-+Note that with kernel TLS enabled some cryptographic operations are performed
	-+by the kernel directly and not via any available OpenSSL Providers. This might
	-+be undesirable if, for example, the application requires all cryptographic
	-+operations to be performed by the FIPS provider.
	-+
	- =back
	-
	- The following options no longer have any effect but their identifiers are
	-diff --git doc/man3/SSL_CTX_set_record_padding_callback.pod doc/man3/SSL_CTX_set_record_padding_callback.pod
	-index 13e56f0c57..247a39fc03 100644
	---- doc/man3/SSL_CTX_set_record_padding_callback.pod
	-+++ doc/man3/SSL_CTX_set_record_padding_callback.pod
	-@@ -16,7 +16,7 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
	- #include <openssl/ssl.h>
	-
	- void SSL_CTX_set_record_padding_callback(SSL_CTX ctx, size_t (cb)(SSL s, int type, size_t len, void arg));
	-- void SSL_set_record_padding_callback(SSL ssl, size_t (cb)(SSL s, int type, size_t len, void arg));
	-+ int SSL_set_record_padding_callback(SSL ssl, size_t (cb)(SSL s, int type, size_t len, void arg));
	-
	- void SSL_CTX_set_record_padding_callback_arg(SSL_CTX ctx, void arg);
	- void SSL_CTX_get_record_padding_callback_arg(const SSL_CTX ctx);
	-@@ -32,6 +32,8 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
	- SSL_CTX_set_record_padding_callback() or SSL_set_record_padding_callback()
	- can be used to assign a callback function I<cb> to specify the padding
	- for TLS 1.3 records. The value set in B<ctx> is copied to a new SSL by SSL_new().
	-+Kernel TLS is not possible if the record padding callback is set, and the callback
	-+function cannot be set if Kernel TLS is already configured for the current SSL object.
	-
	- SSL_CTX_set_record_padding_callback_arg() and SSL_set_record_padding_callback_arg()
	- assign a value B<arg> that is passed to the callback when it is invoked. The value
	-@@ -64,6 +66,9 @@ indicates no padding will be added. A return value that causes the record to
	- exceed the maximum record size (SSL3_RT_MAX_PLAIN_LENGTH) will pad out to the
	- maximum record size.
	-
	-+The SSL_CTX_get_record_padding_callback_arg() function returns 1 on success or 0 if
	-+the callback function is not set because Kernel TLS is configured for the SSL object.
	-+
	- =head1 NOTES
	-
	- The default behavior is to add no padding to the record.
	-@@ -84,6 +89,9 @@ L<ssl(7)>, L<SSL_new(3)>
	-
	- The record padding API was added for TLS 1.3 support in OpenSSL 1.1.1.
	-
	-+The return type of SSL_CTX_set_record_padding_callback() function was
	-+changed to int in OpenSSL 3.0.
	-+
	- =head1 COPYRIGHT
	-
	- Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
	-diff --git doc/man3/SSL_write.pod doc/man3/SSL_write.pod
	-index 5e3ce1e7e4..9b271d8e65 100644
	---- doc/man3/SSL_write.pod
	-+++ doc/man3/SSL_write.pod
	-@@ -2,12 +2,13 @@
	-
	- =head1 NAME
	-
	--SSL_write_ex, SSL_write - write bytes to a TLS/SSL connection
	-+SSL_write_ex, SSL_write, SSL_sendfile - write bytes to a TLS/SSL connection
	-
	- =head1 SYNOPSIS
	-
	- #include <openssl/ssl.h>
	-
	-+ ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags);
	- int SSL_write_ex(SSL s, const void buf, size_t num, size_t *written);
	- int SSL_write(SSL ssl, const void buf, int num);
	-
	-@@ -17,6 +18,14 @@ SSL_write_ex() and SSL_write() write B<num> bytes from the buffer B<buf> into
	- the specified B<ssl> connection. On success SSL_write_ex() will store the number
	- of bytes written in B<*written>.
	-
	-+SSL_sendfile() writes B<size> bytes from offset B<offset> in the file
	-+descriptor B<fd> to the specified SSL connection B<s>. This function provides
	-+efficient zero-copy semantics. SSL_sendfile() is available only when
	-+Kernel TLS is enabled, which can be checked by calling BIO_get_ktls_send().
	-+It is provided here to allow users to maintain the same interface.
	-+The meaning of B<flags> is platform dependent.
	-+Currently, under Linux it is ignored.
	-+
	- =head1 NOTES
	-
	- In the paragraphs below a "write function" is defined as one of either
	-@@ -104,17 +113,36 @@ You should instead call SSL_get_error() to find out if it's retryable.
	-
	- =back
	-
	-+For SSL_sendfile(), the following return values can occur:
	-+
	-+=over 4
	-+
	-+=item Z<>>= 0
	-+
	-+The write operation was successful, the return value is the number
	-+of bytes of the file written to the TLS/SSL connection. The return
	-+value can be less than B<size> for a partial write.
	-+
	-+=item E<lt> 0
	-+
	-+The write operation was not successful, because either the connection was
	-+closed, an error occured or action must be taken by the calling process.
	-+Call SSL_get_error() with the return value to find out the reason.
	-+
	-+=back
	-+
	- =head1 SEE ALSO
	-
	- L<SSL_get_error(3)>, L<SSL_read_ex(3)>, L<SSL_read(3)>
	- L<SSL_CTX_set_mode(3)>, L<SSL_CTX_new(3)>,
	- L<SSL_connect(3)>, L<SSL_accept(3)>
	--L<SSL_set_connect_state(3)>,
	-+L<SSL_set_connect_state(3)>, L<BIO_ctrl(3)>,
	- L<ssl(7)>, L<bio(7)>
	-
	- =head1 HISTORY
	-
	- The SSL_write_ex() function was added in OpenSSL 1.1.1.
	-+The SSL_sendfile() function was added in OpenSSL 3.0.0.
	-
	- =head1 COPYRIGHT
	-
	-diff --git engines/e_afalg.c engines/e_afalg.c
	-index 2d16c13834..748969204e 100644
	---- engines/e_afalg.c
	-+++ engines/e_afalg.c
	-@@ -407,7 +407,7 @@ static int afalg_start_cipher_sk(afalg_ctx actx, const unsigned char in,
	- size_t inl, const unsigned char *iv,
	- unsigned int enc)
	- {
	-- struct msghdr msg = { 0 };
	-+ struct msghdr msg;
	- struct cmsghdr *cmsg;
	- struct iovec iov;
	- ssize_t sbytes;
	-@@ -416,6 +416,7 @@ static int afalg_start_cipher_sk(afalg_ctx actx, const unsigned char in,
	- # endif
	- char cbuf[CMSG_SPACE(ALG_IV_LEN(ALG_AES_IV_LEN)) + CMSG_SPACE(ALG_OP_LEN)];
	-
	-+ memset(&msg, 0, sizeof(msg));
	- memset(cbuf, 0, sizeof(cbuf));
	- msg.msg_control = cbuf;
	- msg.msg_controllen = sizeof(cbuf);
	-diff --git include/internal/bio.h include/internal/bio.h
	-index c343b27629..365d41dabb 100644
	---- include/internal/bio.h
	-+++ include/internal/bio.h
	-@@ -7,6 +7,9 @@
	- * https://www.openssl.org/source/license.html
	- */
	-
	-+#ifndef HEADER_INTERNAL_BIO_H
	-+# define HEADER_INTERNAL_BIO_H
	-+
	- #include <openssl/bio.h>
	-
	- struct bio_method_st {
	-@@ -31,3 +34,39 @@ void bio_cleanup(void);
	- /* Old style to new style BIO_METHOD conversion functions */
	- int bwrite_conv(BIO bio, const char data, size_t datal, size_t *written);
	- int bread_conv(BIO bio, char data, size_t datal, size_t *read);
	-+
	-+/* Changes to these internal BIOs must also update include/openssl/bio.h */
	-+# define BIO_CTRL_SET_KTLS 72
	-+# define BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG 74
	-+# define BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG 75
	-+
	-+/*
	-+ * This is used with socket BIOs:
	-+ * BIO_FLAGS_KTLS_TX means we are using ktls with this BIO for sending.
	-+ * BIO_FLAGS_KTLS_TX_CTRL_MSG means we are about to send a ctrl message next.
	-+ * BIO_FLAGS_KTLS_RX means we are using ktls with this BIO for receiving.
	-+ */
	-+# define BIO_FLAGS_KTLS_TX_CTRL_MSG 0x1000
	-+# define BIO_FLAGS_KTLS_RX 0x2000
	-+# define BIO_FLAGS_KTLS_TX 0x4000
	-+
	-+/* KTLS related controls and flags */
	-+# define BIO_set_ktls_flag(b, is_tx) \
	-+ BIO_set_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX)
	-+# define BIO_should_ktls_flag(b, is_tx) \
	-+ BIO_test_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX)
	-+# define BIO_set_ktls_ctrl_msg_flag(b) \
	-+ BIO_set_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
	-+# define BIO_should_ktls_ctrl_msg_flag(b) \
	-+ BIO_test_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
	-+# define BIO_clear_ktls_ctrl_msg_flag(b) \
	-+ BIO_clear_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
	-+
	-+# define BIO_set_ktls(b, keyblob, is_tx) \
	-+ BIO_ctrl(b, BIO_CTRL_SET_KTLS, is_tx, keyblob)
	-+# define BIO_set_ktls_ctrl_msg(b, record_type) \
	-+ BIO_ctrl(b, BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG, record_type, NULL)
	-+# define BIO_clear_ktls_ctrl_msg(b) \
	-+ BIO_ctrl(b, BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG, 0, NULL)
	-+
	-+#endif
	-diff --git include/internal/ktls.h include/internal/ktls.h
	-new file mode 100644
	-index 0000000000..5f9e3f91ed
	---- /dev/null
	-+++ include/internal/ktls.h
	-@@ -0,0 +1,407 @@
	-+/*
	-+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
	-+ *
	-+ * Licensed under the Apache License 2.0 (the "License"). You may not use
	-+ * this file except in compliance with the License. You can obtain a copy
	-+ * in the file LICENSE in the source distribution or at
	-+ * https://www.openssl.org/source/license.html
	-+ */
	-+
	-+#if defined(OPENSSL_SYS_LINUX)
	-+# ifndef OPENSSL_NO_KTLS
	-+# include <linux/version.h>
	-+# if LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0)
	-+# define OPENSSL_NO_KTLS
	-+# ifndef PEDANTIC
	-+# warning "KTLS requires Kernel Headers >= 4.13.0"
	-+# warning "Skipping Compilation of KTLS"
	-+# endif
	-+# endif
	-+# endif
	-+#endif
	-+
	-+#ifndef HEADER_INTERNAL_KTLS
	-+# define HEADER_INTERNAL_KTLS
	-+# ifndef OPENSSL_NO_KTLS
	-+
	-+# if defined(__FreeBSD__)
	-+# include <sys/types.h>
	-+# include <sys/socket.h>
	-+# include <sys/ktls.h>
	-+# include <netinet/in.h>
	-+# include <netinet/tcp.h>
	-+# include "openssl/ssl3.h"
	-+
	-+# ifndef TCP_RXTLS_ENABLE
	-+# define OPENSSL_NO_KTLS_RX
	-+# endif
	-+# define OPENSSL_KTLS_AES_GCM_128
	-+# define OPENSSL_KTLS_AES_GCM_256
	-+# define OPENSSL_KTLS_TLS13
	-+# ifdef TLS_CHACHA20_IV_LEN
	-+# ifndef OPENSSL_NO_CHACHA
	-+# define OPENSSL_KTLS_CHACHA20_POLY1305
	-+# endif
	-+# endif
	-+
	-+typedef struct tls_enable ktls_crypto_info_t;
	-+
	-+/*
	-+ * FreeBSD does not require any additional steps to enable KTLS before
	-+ * setting keys.
	-+ */
	-+static ossl_inline int ktls_enable(int fd)
	-+{
	-+ return 1;
	-+}
	-+
	-+/*
	-+ * The TCP_TXTLS_ENABLE socket option marks the outgoing socket buffer
	-+ * as using TLS. If successful, then data sent using this socket will
	-+ * be encrypted and encapsulated in TLS records using the tls_en
	-+ * provided here.
	-+ *
	-+ * The TCP_RXTLS_ENABLE socket option marks the incoming socket buffer
	-+ * as using TLS. If successful, then data received for this socket will
	-+ * be authenticated and decrypted using the tls_en provided here.
	-+ */
	-+static ossl_inline int ktls_start(int fd, ktls_crypto_info_t *tls_en, int is_tx)
	-+{
	-+ if (is_tx)
	-+ return setsockopt(fd, IPPROTO_TCP, TCP_TXTLS_ENABLE,
	-+ tls_en, sizeof(*tls_en)) ? 0 : 1;
	-+# ifndef OPENSSL_NO_KTLS_RX
	-+ return setsockopt(fd, IPPROTO_TCP, TCP_RXTLS_ENABLE, tls_en,
	-+ sizeof(*tls_en)) ? 0 : 1;
	-+# else
	-+ return 0;
	-+# endif
	-+}
	-+
	-+/*
	-+ * Send a TLS record using the tls_en provided in ktls_start and use
	-+ * record_type instead of the default SSL3_RT_APPLICATION_DATA.
	-+ * When the socket is non-blocking, then this call either returns EAGAIN or
	-+ * the entire record is pushed to TCP. It is impossible to send a partial
	-+ * record using this control message.
	-+ */
	-+static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type,
	-+ const void *data, size_t length)
	-+{
	-+ struct msghdr msg = { 0 };
	-+ int cmsg_len = sizeof(record_type);
	-+ struct cmsghdr *cmsg;
	-+ char buf[CMSG_SPACE(cmsg_len)];
	-+ struct iovec msg_iov; /* Vector of data to send/receive into */
	-+
	-+ msg.msg_control = buf;
	-+ msg.msg_controllen = sizeof(buf);
	-+ cmsg = CMSG_FIRSTHDR(&msg);
	-+ cmsg->cmsg_level = IPPROTO_TCP;
	-+ cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
	-+ cmsg->cmsg_len = CMSG_LEN(cmsg_len);
	-+ ((unsigned char )CMSG_DATA(cmsg)) = record_type;
	-+ msg.msg_controllen = cmsg->cmsg_len;
	-+
	-+ msg_iov.iov_base = (void *)data;
	-+ msg_iov.iov_len = length;
	-+ msg.msg_iov = &msg_iov;
	-+ msg.msg_iovlen = 1;
	-+
	-+ return sendmsg(fd, &msg, 0);
	-+}
	-+
	-+# ifdef OPENSSL_NO_KTLS_RX
	-+
	-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
	-+{
	-+ return -1;
	-+}
	-+
	-+# else /* !defined(OPENSSL_NO_KTLS_RX) */
	-+
	-+/*
	-+ * Receive a TLS record using the tls_en provided in ktls_start. The
	-+ * kernel strips any explicit IV and authentication tag, but provides
	-+ * the TLS record header via a control message. If there is an error
	-+ * with the TLS record such as an invalid header, invalid padding, or
	-+ * authentication failure recvmsg() will fail with an error.
	-+ */
	-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
	-+{
	-+ struct msghdr msg = { 0 };
	-+ int cmsg_len = sizeof(struct tls_get_record);
	-+ struct tls_get_record *tgr;
	-+ struct cmsghdr *cmsg;
	-+ char buf[CMSG_SPACE(cmsg_len)];
	-+ struct iovec msg_iov; /* Vector of data to send/receive into */
	-+ int ret;
	-+ unsigned char *p = data;
	-+ const size_t prepend_length = SSL3_RT_HEADER_LENGTH;
	-+
	-+ if (length <= prepend_length) {
	-+ errno = EINVAL;
	-+ return -1;
	-+ }
	-+
	-+ msg.msg_control = buf;
	-+ msg.msg_controllen = sizeof(buf);
	-+
	-+ msg_iov.iov_base = p + prepend_length;
	-+ msg_iov.iov_len = length - prepend_length;
	-+ msg.msg_iov = &msg_iov;
	-+ msg.msg_iovlen = 1;
	-+
	-+ ret = recvmsg(fd, &msg, 0);
	-+ if (ret <= 0)
	-+ return ret;
	-+
	-+ if ((msg.msg_flags & (MSG_EOR \| MSG_CTRUNC)) != MSG_EOR) {
	-+ errno = EMSGSIZE;
	-+ return -1;
	-+ }
	-+
	-+ if (msg.msg_controllen == 0) {
	-+ errno = EBADMSG;
	-+ return -1;
	-+ }
	-+
	-+ cmsg = CMSG_FIRSTHDR(&msg);
	-+ if (cmsg->cmsg_level != IPPROTO_TCP \|\| cmsg->cmsg_type != TLS_GET_RECORD
	-+ \|\| cmsg->cmsg_len != CMSG_LEN(cmsg_len)) {
	-+ errno = EBADMSG;
	-+ return -1;
	-+ }
	-+
	-+ tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
	-+ p[0] = tgr->tls_type;
	-+ p[1] = tgr->tls_vmajor;
	-+ p[2] = tgr->tls_vminor;
	-+ (uint16_t )(p + 3) = htons(ret);
	-+
	-+ return ret + prepend_length;
	-+}
	-+
	-+# endif /* OPENSSL_NO_KTLS_RX */
	-+
	-+/*
	-+ * KTLS enables the sendfile system call to send data from a file over
	-+ * TLS.
	-+ */
	-+static ossl_inline ossl_ssize_t ktls_sendfile(int s, int fd, off_t off,
	-+ size_t size, int flags)
	-+{
	-+ off_t sbytes = 0;
	-+ int ret;
	-+
	-+ ret = sendfile(fd, s, off, size, NULL, &sbytes, flags);
	-+ if (ret == -1 && sbytes == 0)
	-+ return -1;
	-+ return sbytes;
	-+}
	-+
	-+# endif /* __FreeBSD__ */
	-+
	-+# if defined(OPENSSL_SYS_LINUX)
	-+
	-+# include <linux/tls.h>
	-+# if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
	-+# define OPENSSL_NO_KTLS_RX
	-+# ifndef PEDANTIC
	-+# warning "KTLS requires Kernel Headers >= 4.17.0 for receiving"
	-+# warning "Skipping Compilation of KTLS receive data path"
	-+# endif
	-+# endif
	-+# define OPENSSL_KTLS_AES_GCM_128
	-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
	-+# define OPENSSL_KTLS_AES_GCM_256
	-+# define OPENSSL_KTLS_TLS13
	-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 2, 0)
	-+# define OPENSSL_KTLS_AES_CCM_128
	-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
	-+# ifndef OPENSSL_NO_CHACHA
	-+# define OPENSSL_KTLS_CHACHA20_POLY1305
	-+# endif
	-+# endif
	-+# endif
	-+# endif
	-+
	-+# include <sys/sendfile.h>
	-+# include <netinet/tcp.h>
	-+# include <linux/socket.h>
	-+# include "openssl/ssl3.h"
	-+# include "openssl/tls1.h"
	-+# include "openssl/evp.h"
	-+
	-+# ifndef SOL_TLS
	-+# define SOL_TLS 282
	-+# endif
	-+
	-+# ifndef TCP_ULP
	-+# define TCP_ULP 31
	-+# endif
	-+
	-+# ifndef TLS_RX
	-+# define TLS_RX 2
	-+# endif
	-+
	-+struct tls_crypto_info_all {
	-+ union {
	-+# ifdef OPENSSL_KTLS_AES_GCM_128
	-+ struct tls12_crypto_info_aes_gcm_128 gcm128;
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_GCM_256
	-+ struct tls12_crypto_info_aes_gcm_256 gcm256;
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_CCM_128
	-+ struct tls12_crypto_info_aes_ccm_128 ccm128;
	-+# endif
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ struct tls12_crypto_info_chacha20_poly1305 chacha20poly1305;
	-+# endif
	-+ };
	-+ size_t tls_crypto_info_len;
	-+};
	-+
	-+typedef struct tls_crypto_info_all ktls_crypto_info_t;
	-+
	-+/*
	-+ * When successful, this socket option doesn't change the behaviour of the
	-+ * TCP socket, except changing the TCP setsockopt handler to enable the
	-+ * processing of SOL_TLS socket options. All other functionality remains the
	-+ * same.
	-+ */
	-+static ossl_inline int ktls_enable(int fd)
	-+{
	-+ return setsockopt(fd, SOL_TCP, TCP_ULP, "tls", sizeof("tls")) ? 0 : 1;
	-+}
	-+
	-+/*
	-+ * The TLS_TX socket option changes the send/sendmsg handlers of the TCP socket.
	-+ * If successful, then data sent using this socket will be encrypted and
	-+ * encapsulated in TLS records using the crypto_info provided here.
	-+ * The TLS_RX socket option changes the recv/recvmsg handlers of the TCP socket.
	-+ * If successful, then data received using this socket will be decrypted,
	-+ * authenticated and decapsulated using the crypto_info provided here.
	-+ */
	-+static ossl_inline int ktls_start(int fd, ktls_crypto_info_t *crypto_info,
	-+ int is_tx)
	-+{
	-+ return setsockopt(fd, SOL_TLS, is_tx ? TLS_TX : TLS_RX,
	-+ crypto_info, crypto_info->tls_crypto_info_len) ? 0 : 1;
	-+}
	-+
	-+/*
	-+ * Send a TLS record using the crypto_info provided in ktls_start and use
	-+ * record_type instead of the default SSL3_RT_APPLICATION_DATA.
	-+ * When the socket is non-blocking, then this call either returns EAGAIN or
	-+ * the entire record is pushed to TCP. It is impossible to send a partial
	-+ * record using this control message.
	-+ */
	-+static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type,
	-+ const void *data, size_t length)
	-+{
	-+ struct msghdr msg;
	-+ int cmsg_len = sizeof(record_type);
	-+ struct cmsghdr *cmsg;
	-+ union {
	-+ struct cmsghdr hdr;
	-+ char buf[CMSG_SPACE(sizeof(unsigned char))];
	-+ } cmsgbuf;
	-+ struct iovec msg_iov; /* Vector of data to send/receive into */
	-+
	-+ memset(&msg, 0, sizeof(msg));
	-+ msg.msg_control = cmsgbuf.buf;
	-+ msg.msg_controllen = sizeof(cmsgbuf.buf);
	-+ cmsg = CMSG_FIRSTHDR(&msg);
	-+ cmsg->cmsg_level = SOL_TLS;
	-+ cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
	-+ cmsg->cmsg_len = CMSG_LEN(cmsg_len);
	-+ ((unsigned char )CMSG_DATA(cmsg)) = record_type;
	-+ msg.msg_controllen = cmsg->cmsg_len;
	-+
	-+ msg_iov.iov_base = (void *)data;
	-+ msg_iov.iov_len = length;
	-+ msg.msg_iov = &msg_iov;
	-+ msg.msg_iovlen = 1;
	-+
	-+ return sendmsg(fd, &msg, 0);
	-+}
	-+
	-+/*
	-+ * KTLS enables the sendfile system call to send data from a file over TLS.
	-+ * @flags are ignored on Linux. (placeholder for FreeBSD sendfile)
	-+ * */
	-+static ossl_inline ossl_ssize_t ktls_sendfile(int s, int fd, off_t off, size_t size, int flags)
	-+{
	-+ return sendfile(s, fd, &off, size);
	-+}
	-+
	-+# ifdef OPENSSL_NO_KTLS_RX
	-+
	-+
	-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
	-+{
	-+ return -1;
	-+}
	-+
	-+# else /* !defined(OPENSSL_NO_KTLS_RX) */
	-+
	-+/*
	-+ * Receive a TLS record using the crypto_info provided in ktls_start.
	-+ * The kernel strips the TLS record header, IV and authentication tag,
	-+ * returning only the plaintext data or an error on failure.
	-+ * We add the TLS record header here to satisfy routines in rec_layer_s3.c
	-+ */
	-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
	-+{
	-+ struct msghdr msg;
	-+ struct cmsghdr *cmsg;
	-+ union {
	-+ struct cmsghdr hdr;
	-+ char buf[CMSG_SPACE(sizeof(unsigned char))];
	-+ } cmsgbuf;
	-+ struct iovec msg_iov;
	-+ int ret;
	-+ unsigned char *p = data;
	-+ const size_t prepend_length = SSL3_RT_HEADER_LENGTH;
	-+
	-+ if (length < prepend_length + EVP_GCM_TLS_TAG_LEN) {
	-+ errno = EINVAL;
	-+ return -1;
	-+ }
	-+
	-+ memset(&msg, 0, sizeof(msg));
	-+ msg.msg_control = cmsgbuf.buf;
	-+ msg.msg_controllen = sizeof(cmsgbuf.buf);
	-+
	-+ msg_iov.iov_base = p + prepend_length;
	-+ msg_iov.iov_len = length - prepend_length - EVP_GCM_TLS_TAG_LEN;
	-+ msg.msg_iov = &msg_iov;
	-+ msg.msg_iovlen = 1;
	-+
	-+ ret = recvmsg(fd, &msg, 0);
	-+ if (ret < 0)
	-+ return ret;
	-+
	-+ if (msg.msg_controllen > 0) {
	-+ cmsg = CMSG_FIRSTHDR(&msg);
	-+ if (cmsg->cmsg_type == TLS_GET_RECORD_TYPE) {
	-+ p[0] = ((unsigned char )CMSG_DATA(cmsg));
	-+ p[1] = TLS1_2_VERSION_MAJOR;
	-+ p[2] = TLS1_2_VERSION_MINOR;
	-+ /* returned length is limited to msg_iov.iov_len above */
	-+ p[3] = (ret >> 8) & 0xff;
	-+ p[4] = ret & 0xff;
	-+ ret += prepend_length;
	-+ }
	-+ }
	-+
	-+ return ret;
	-+}
	-+
	-+# endif /* OPENSSL_NO_KTLS_RX */
	-+
	-+# endif /* OPENSSL_SYS_LINUX */
	-+# endif /* OPENSSL_NO_KTLS */
	-+#endif /* HEADER_INTERNAL_KTLS */
	-diff --git include/openssl/bio.h include/openssl/bio.h
	-index ae559a5105..66fc0d7c4a 100644
	---- include/openssl/bio.h
	-+++ include/openssl/bio.h
	-@@ -141,6 +141,26 @@ extern "C" {
	-
	- # define BIO_CTRL_DGRAM_SET_PEEK_MODE 71
	-
	-+/*
	-+ * internal BIO see include/internal/bio.h:
	-+ * # define BIO_CTRL_SET_KTLS_SEND 72
	-+ * # define BIO_CTRL_SET_KTLS_SEND_CTRL_MSG 74
	-+ * # define BIO_CTRL_CLEAR_KTLS_CTRL_MSG 75
	-+ */
	-+
	-+# define BIO_CTRL_GET_KTLS_SEND 73
	-+# define BIO_CTRL_GET_KTLS_RECV 76
	-+
	-+# ifndef OPENSSL_NO_KTLS
	-+# define BIO_get_ktls_send(b) \
	-+ BIO_ctrl(b, BIO_CTRL_GET_KTLS_SEND, 0, NULL)
	-+# define BIO_get_ktls_recv(b) \
	-+ BIO_ctrl(b, BIO_CTRL_GET_KTLS_RECV, 0, NULL)
	-+# else
	-+# define BIO_get_ktls_send(b) (0)
	-+# define BIO_get_ktls_recv(b) (0)
	-+# endif
	-+
	- /* modifiers */
	- # define BIO_FP_READ 0x02
	- # define BIO_FP_WRITE 0x04
	-@@ -171,6 +191,8 @@ extern "C" {
	- # define BIO_FLAGS_NONCLEAR_RST 0x400
	- # define BIO_FLAGS_IN_EOF 0x800
	-
	-+/* the BIO FLAGS values 0x1000 to 0x4000 are reserved for internal KTLS flags */
	-+
	- typedef union bio_addr_st BIO_ADDR;
	- typedef struct bio_addrinfo_st BIO_ADDRINFO;
	-
	-diff --git include/openssl/err.h include/openssl/err.h
	-index b49f88129e..dce9885d3f 100644
	---- include/openssl/err.h
	-+++ include/openssl/err.h
	-@@ -169,6 +169,7 @@ typedef struct err_state_st {
	- # define SYS_F_STAT 22
	- # define SYS_F_FCNTL 23
	- # define SYS_F_FSTAT 24
	-+# define SYS_F_SENDFILE 25
	-
	- /* reasons */
	- # define ERR_R_SYS_LIB ERR_LIB_SYS/* 2 */
	-diff --git include/openssl/evp.h include/openssl/evp.h
	-index a411f3f2f9..60103707d2 100644
	---- include/openssl/evp.h
	-+++ include/openssl/evp.h
	-@@ -352,6 +352,8 @@ int (EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER cipher))(EVP_CIPHER_CTX *,
	- # define EVP_CTRL_SET_PIPELINE_INPUT_LENS 0x24
	-
	- # define EVP_CTRL_GET_IVLEN 0x25
	-+/* Get the IV used by the cipher */
	-+# define EVP_CTRL_GET_IV 0x26
	-
	- /* Padding modes */
	- #define EVP_PADDING_PKCS7 1
	-diff --git include/openssl/ssl.h include/openssl/ssl.h
	-index fd0c5a9996..cfb87e6322 100644
	---- include/openssl/ssl.h
	-+++ include/openssl/ssl.h
	-@@ -303,7 +303,9 @@ typedef int (SSL_verify_cb)(int preverify_ok, X509_STORE_CTX x509_ctx);
	- /* Allow initial connection to servers that don't support RI */
	- # define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004U
	-
	--/* Reserved value (until OpenSSL 1.2.0) 0x00000008U */
	-+/* Enable support for Kernel TLS */
	-+# define SSL_OP_ENABLE_KTLS 0x00000008U
	-+
	- # define SSL_OP_TLSEXT_PADDING 0x00000010U
	- /* Reserved value (until OpenSSL 1.2.0) 0x00000020U */
	- # define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040U
	-@@ -1837,6 +1839,8 @@ __owur int SSL_read_early_data(SSL s, void buf, size_t num,
	- size_t *readbytes);
	- __owur int SSL_peek(SSL ssl, void buf, int num);
	- __owur int SSL_peek_ex(SSL ssl, void buf, size_t num, size_t *readbytes);
	-+__owur ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size,
	-+ int flags);
	- __owur int SSL_write(SSL ssl, const void buf, int num);
	- __owur int SSL_write_ex(SSL s, const void buf, size_t num, size_t *written);
	- __owur int SSL_write_early_data(SSL s, const void buf, size_t num,
	-@@ -2123,7 +2127,7 @@ void SSL_CTX_set_record_padding_callback_arg(SSL_CTX ctx, void arg);
	- void SSL_CTX_get_record_padding_callback_arg(const SSL_CTX ctx);
	- int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);
	-
	--void SSL_set_record_padding_callback(SSL *ssl,
	-+int SSL_set_record_padding_callback(SSL *ssl,
	- size_t (cb) (SSL ssl, int type,
	- size_t len, void *arg));
	- void SSL_set_record_padding_callback_arg(SSL ssl, void arg);
	-diff --git include/openssl/sslerr.h include/openssl/sslerr.h
	-index 701d61c6e9..c0310941c4 100644
	---- include/openssl/sslerr.h
	-+++ include/openssl/sslerr.h
	-@@ -220,6 +220,7 @@ int ERR_load_SSL_strings(void);
	- # define SSL_F_SSL_RENEGOTIATE_ABBREVIATED 546
	- # define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT 320
	- # define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT 321
	-+# define SSL_F_SSL_SENDFILE 639
	- # define SSL_F_SSL_SESSION_DUP 348
	- # define SSL_F_SSL_SESSION_NEW 189
	- # define SSL_F_SSL_SESSION_PRINT_FP 190
	-diff --git ssl/build.info ssl/build.info
	-index bb2f1deb53..1c49ac9aee 100644
	---- ssl/build.info
	-+++ ssl/build.info
	-@@ -1,4 +1,5 @@
	- LIBS=../libssl
	-+
	- SOURCE[../libssl]=\
	- pqueue.c packet.c \
	- statem/statem_srvr.c statem/statem_clnt.c s3_lib.c s3_enc.c record/rec_layer_s3.c \
	-@@ -13,3 +14,7 @@ SOURCE[../libssl]=\
	- bio_ssl.c ssl_err.c tls_srp.c t1_trce.c ssl_utst.c \
	- record/ssl3_buffer.c record/ssl3_record.c record/dtls1_bitmap.c \
	- statem/statem.c record/ssl3_record_tls13.c
	-+
	-+IF[{- !$disabled{ktls} -}]
	-+ SOURCE[../libssl]=ktls.c
	-+ENDIF
	-diff --git ssl/ktls.c ssl/ktls.c
	-new file mode 100644
	-index 0000000000..68482ac480
	---- /dev/null
	-+++ ssl/ktls.c
	-@@ -0,0 +1,321 @@
	-+/*
	-+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
	-+ *
	-+ * Licensed under the Apache License 2.0 (the "License"). You may not use
	-+ * this file except in compliance with the License. You can obtain a copy
	-+ * in the file LICENSE in the source distribution or at
	-+ * https://www.openssl.org/source/license.html
	-+ */
	-+
	-+#include "ssl_local.h"
	-+#include "internal/ktls.h"
	-+
	-+#ifndef OPENSSL_NO_KTLS_RX
	-+ /*
	-+ * Count the number of records that were not processed yet from record boundary.
	-+ *
	-+ * This function assumes that there are only fully formed records read in the
	-+ * record layer. If read_ahead is enabled, then this might be false and this
	-+ * function will fail.
	-+ */
	-+static int count_unprocessed_records(SSL *s)
	-+{
	-+ SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
	-+ PACKET pkt, subpkt;
	-+ int count = 0;
	-+
	-+ if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left))
	-+ return -1;
	-+
	-+ while (PACKET_remaining(&pkt) > 0) {
	-+ /* Skip record type and version */
	-+ if (!PACKET_forward(&pkt, 3))
	-+ return -1;
	-+
	-+ /* Read until next record */
	-+ if (!PACKET_get_length_prefixed_2(&pkt, &subpkt))
	-+ return -1;
	-+
	-+ count += 1;
	-+ }
	-+
	-+ return count;
	-+}
	-+
	-+/*
	-+ * The kernel cannot offload receive if a partial TLS record has been read.
	-+ * Check the read buffer for unprocessed records. If the buffer contains a
	-+ * partial record, fail and return 0. Otherwise, update the sequence
	-+ * number at *rec_seq for the count of unprocessed records and return 1.
	-+ */
	-+static int check_rx_read_ahead(SSL s, unsigned char rec_seq)
	-+{
	-+ int bit, count_unprocessed;
	-+
	-+ count_unprocessed = count_unprocessed_records(s);
	-+ if (count_unprocessed < 0)
	-+ return 0;
	-+
	-+ /* increment the crypto_info record sequence */
	-+ while (count_unprocessed) {
	-+ for (bit = 7; bit >= 0; bit--) { /* increment */
	-+ ++rec_seq[bit];
	-+ if (rec_seq[bit] != 0)
	-+ break;
	-+ }
	-+ count_unprocessed--;
	-+
	-+ }
	-+
	-+ return 1;
	-+}
	-+#endif
	-+
	-+#if defined(__FreeBSD__)
	-+# include <crypto/cryptodev.h>
	-+
	-+/*-
	-+ * Check if a given cipher is supported by the KTLS interface.
	-+ * The kernel might still fail the setsockopt() if no suitable
	-+ * provider is found, but this checks if the socket option
	-+ * supports the cipher suite used at all.
	-+ */
	-+int ktls_check_supported_cipher(const SSL s, const EVP_CIPHER c,
	-+ const EVP_CIPHER_CTX *dd)
	-+{
	-+
	-+ switch (s->version) {
	-+ case TLS1_VERSION:
	-+ case TLS1_1_VERSION:
	-+ case TLS1_2_VERSION:
	-+ case TLS1_3_VERSION:
	-+ break;
	-+ default:
	-+ return 0;
	-+ }
	-+
	-+ switch (s->s3->tmp.new_cipher->algorithm_enc) {
	-+ case SSL_AES128GCM:
	-+ case SSL_AES256GCM:
	-+ return 1;
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ case SSL_CHACHA20POLY1305:
	-+ return 1;
	-+# endif
	-+ case SSL_AES128:
	-+ case SSL_AES256:
	-+ if (s->ext.use_etm)
	-+ return 0;
	-+ switch (s->s3->tmp.new_cipher->algorithm_mac) {
	-+ case SSL_SHA1:
	-+ case SSL_SHA256:
	-+ case SSL_SHA384:
	-+ return 1;
	-+ default:
	-+ return 0;
	-+ }
	-+ default:
	-+ return 0;
	-+ }
	-+}
	-+
	-+/* Function to configure kernel TLS structure */
	-+int ktls_configure_crypto(SSL s, const EVP_CIPHER c, EVP_CIPHER_CTX *dd,
	-+ void rl_sequence, ktls_crypto_info_t crypto_info,
	-+ int is_tx, unsigned char *iv,
	-+ unsigned char key, unsigned char mac_key,
	-+ size_t mac_secret_size)
	-+{
	-+ memset(crypto_info, 0, sizeof(*crypto_info));
	-+ switch (s->s3->tmp.new_cipher->algorithm_enc) {
	-+ case SSL_AES128GCM:
	-+ case SSL_AES256GCM:
	-+ crypto_info->cipher_algorithm = CRYPTO_AES_NIST_GCM_16;
	-+ if (s->version == TLS1_3_VERSION)
	-+ crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd);
	-+ else
	-+ crypto_info->iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
	-+ break;
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ case SSL_CHACHA20POLY1305:
	-+ crypto_info->cipher_algorithm = CRYPTO_CHACHA20_POLY1305;
	-+ crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd);
	-+ break;
	-+# endif
	-+ case SSL_AES128:
	-+ case SSL_AES256:
	-+ switch (s->s3->tmp.new_cipher->algorithm_mac) {
	-+ case SSL_SHA1:
	-+ crypto_info->auth_algorithm = CRYPTO_SHA1_HMAC;
	-+ break;
	-+ case SSL_SHA256:
	-+ crypto_info->auth_algorithm = CRYPTO_SHA2_256_HMAC;
	-+ break;
	-+ case SSL_SHA384:
	-+ crypto_info->auth_algorithm = CRYPTO_SHA2_384_HMAC;
	-+ break;
	-+ default:
	-+ return 0;
	-+ }
	-+ crypto_info->cipher_algorithm = CRYPTO_AES_CBC;
	-+ crypto_info->iv_len = EVP_CIPHER_iv_length(c);
	-+ crypto_info->auth_key = mac_key;
	-+ crypto_info->auth_key_len = mac_secret_size;
	-+ break;
	-+ default:
	-+ return 0;
	-+ }
	-+ crypto_info->cipher_key = key;
	-+ crypto_info->cipher_key_len = EVP_CIPHER_key_length(c);
	-+ crypto_info->iv = iv;
	-+ crypto_info->tls_vmajor = (s->version >> 8) & 0x000000ff;
	-+ crypto_info->tls_vminor = (s->version & 0x000000ff);
	-+# ifdef TCP_RXTLS_ENABLE
	-+ memcpy(crypto_info->rec_seq, rl_sequence, sizeof(crypto_info->rec_seq));
	-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->rec_seq))
	-+ return 0;
	-+# else
	-+ if (!is_tx)
	-+ return 0;
	-+# endif
	-+ return 1;
	-+};
	-+
	-+#endif /* __FreeBSD__ */
	-+
	-+#if defined(OPENSSL_SYS_LINUX)
	-+
	-+/* Function to check supported ciphers in Linux */
	-+int ktls_check_supported_cipher(const SSL s, const EVP_CIPHER c,
	-+ const EVP_CIPHER_CTX *dd)
	-+{
	-+ switch (s->version) {
	-+ case TLS1_2_VERSION:
	-+ case TLS1_3_VERSION:
	-+ break;
	-+ default:
	-+ return 0;
	-+ }
	-+
	-+ /* check that cipher is AES_GCM_128, AES_GCM_256, AES_CCM_128
	-+ * or Chacha20-Poly1305
	-+ */
	-+# ifdef OPENSSL_KTLS_AES_CCM_128
	-+ if (EVP_CIPHER_is_a(c, "AES-128-CCM")) {
	-+ if (s->version == TLS_1_3_VERSION /* broken on 5.x kernels */
	-+ \|\| EVP_CIPHER_CTX_get_tag_length(dd) != EVP_CCM_TLS_TAG_LEN)
	-+ return 0;
	-+ return 1;
	-+ } else
	-+# endif
	-+ if (0
	-+# ifdef OPENSSL_KTLS_AES_GCM_128
	-+ \|\| EVP_CIPHER_is_a(c, "AES-128-GCM")
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_GCM_256
	-+ \|\| EVP_CIPHER_is_a(c, "AES-256-GCM")
	-+# endif
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ \|\| EVP_CIPHER_is_a(c, "ChaCha20-Poly1305")
	-+# endif
	-+ ) {
	-+ return 1;
	-+ }
	-+ return 0;
	-+}
	-+
	-+/* Function to configure kernel TLS structure */
	-+int ktls_configure_crypto(SSL s, const EVP_CIPHER c, EVP_CIPHER_CTX *dd,
	-+ void rl_sequence, ktls_crypto_info_t crypto_info,
	-+ int is_tx, unsigned char *iv,
	-+ unsigned char key, unsigned char mac_key,
	-+ size_t mac_secret_size)
	-+{
	-+ unsigned char geniv[12];
	-+ unsigned char *iiv = iv;
	-+
	-+# ifdef OPENSSL_NO_KTLS_RX
	-+ if (!is_tx)
	-+ return 0;
	-+# endif
	-+
	-+ if (s->version == TLS1_2_VERSION &&
	-+ EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {
	-+ EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GET_IV,
	-+ EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN,
	-+ geniv);
	-+ iiv = geniv;
	-+ }
	-+
	-+ memset(crypto_info, 0, sizeof(*crypto_info));
	-+ switch (EVP_CIPHER_nid(c))
	-+ {
	-+# ifdef OPENSSL_KTLS_AES_GCM_128
	-+ case NID_aes_128_gcm:
	-+ crypto_info->gcm128.info.cipher_type = TLS_CIPHER_AES_GCM_128;
	-+ crypto_info->gcm128.info.version = s->version;
	-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm128);
	-+ memcpy(crypto_info->gcm128.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN,
	-+ TLS_CIPHER_AES_GCM_128_IV_SIZE);
	-+ memcpy(crypto_info->gcm128.salt, iiv, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
	-+ memcpy(crypto_info->gcm128.key, key, EVP_CIPHER_key_length(c));
	-+ memcpy(crypto_info->gcm128.rec_seq, rl_sequence,
	-+ TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
	-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm128.rec_seq))
	-+ return 0;
	-+ return 1;
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_GCM_256
	-+ case NID_aes_256_gcm:
	-+ crypto_info->gcm256.info.cipher_type = TLS_CIPHER_AES_GCM_256;
	-+ crypto_info->gcm256.info.version = s->version;
	-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm256);
	-+ memcpy(crypto_info->gcm256.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN,
	-+ TLS_CIPHER_AES_GCM_256_IV_SIZE);
	-+ memcpy(crypto_info->gcm256.salt, iiv, TLS_CIPHER_AES_GCM_256_SALT_SIZE);
	-+ memcpy(crypto_info->gcm256.key, key, EVP_CIPHER_key_length(c));
	-+ memcpy(crypto_info->gcm256.rec_seq, rl_sequence,
	-+ TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
	-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm256.rec_seq))
	-+ return 0;
	-+ return 1;
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_CCM_128
	-+ case NID_aes_128_ccm:
	-+ crypto_info->ccm128.info.cipher_type = TLS_CIPHER_AES_CCM_128;
	-+ crypto_info->ccm128.info.version = s->version;
	-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->ccm128);
	-+ memcpy(crypto_info->ccm128.iv, iiv + EVP_CCM_TLS_FIXED_IV_LEN,
	-+ TLS_CIPHER_AES_CCM_128_IV_SIZE);
	-+ memcpy(crypto_info->ccm128.salt, iiv, TLS_CIPHER_AES_CCM_128_SALT_SIZE);
	-+ memcpy(crypto_info->ccm128.key, key, EVP_CIPHER_key_length(c));
	-+ memcpy(crypto_info->ccm128.rec_seq, rl_sequence,
	-+ TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE);
	-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->ccm128.rec_seq))
	-+ return 0;
	-+ return 1;
	-+# endif
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ case NID_chacha20_poly1305:
	-+ crypto_info->chacha20poly1305.info.cipher_type = TLS_CIPHER_CHACHA20_POLY1305;
	-+ crypto_info->chacha20poly1305.info.version = s->version;
	-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->chacha20poly1305);
	-+ memcpy(crypto_info->chacha20poly1305.iv, iiv,
	-+ TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE);
	-+ memcpy(crypto_info->chacha20poly1305.key, key,
	-+ EVP_CIPHER_get_key_length(c));
	-+ memcpy(crypto_info->chacha20poly1305.rec_seq, rl_sequence,
	-+ TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE);
	-+ if (!is_tx
	-+ && !check_rx_read_ahead(s,
	-+ crypto_info->chacha20poly1305.rec_seq))
	-+ return 0;
	-+ return 1;
	-+# endif
	-+ default:
	-+ return 0;
	-+ }
	-+
	-+}
	-+
	-+#endif /* OPENSSL_SYS_LINUX */
	-diff --git ssl/record/rec_layer_s3.c ssl/record/rec_layer_s3.c
	-index 8249b4ace9..1356bd7b7b 100644
	---- ssl/record/rec_layer_s3.c
	-+++ ssl/record/rec_layer_s3.c
	-@@ -281,11 +281,15 @@
	- return -1;
	- }
	-
	-- /* We always act like read_ahead is set for DTLS */
	-- if (!s->rlayer.read_ahead && !SSL_IS_DTLS(s))
	-+ /*
	-+ * Ktls always reads full records.
	-+ * Also, we always act like read_ahead is set for DTLS.
	-+ */
	-+ if (!BIO_get_ktls_recv(s->rbio) && !s->rlayer.read_ahead
	-+ && !SSL_IS_DTLS(s)) {
	- /* ignore max parameter */
	- max = n;
	-- else {
	-+ } else {
	- if (max < n)
	- max = n;
	- if (max > rb->len - rb->offset)
	-@@ -435,6 +439,7 @@
	- len >= 4 * (max_send_fragment = ssl_get_max_send_fragment(s)) &&
	- s->compress == NULL && s->msg_callback == NULL &&
	- !SSL_WRITE_ETM(s) && SSL_USE_EXPLICIT_IV(s) &&
	-+ (BIO_get_ktls_send(s->wbio) == 0) &&
	- EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_write_ctx)) &
	- EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK) {
	- unsigned char aad[13];
	-@@ -764,6 +769,19 @@
	- s->s3->empty_fragment_done = 1;
	- }
	-
	-+ if (BIO_get_ktls_send(s->wbio)) {
	-+ /*
	-+ * ktls doesn't modify the buffer, but to avoid a warning we need to
	-+ * discard the const qualifier.
	-+ * This doesn't leak memory because the buffers have been released when
	-+ * switching to ktls.
	-+ */
	-+ SSL3_BUFFER_set_buf(&s->rlayer.wbuf[0], (unsigned char *)buf);
	-+ SSL3_BUFFER_set_offset(&s->rlayer.wbuf[0], 0);
	-+ SSL3_BUFFER_set_app_buffer(&s->rlayer.wbuf[0], 1);
	-+ goto wpacket_init_complete;
	-+ }
	-+
	- if (create_empty_fragment) {
	- wb = &s->rlayer.wbuf[0];
	- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
	-@@ -833,6 +851,8 @@
	- }
	- }
	-
	-+ wpacket_init_complete:
	-+
	- totlen = 0;
	- /* Clear our SSL3_RECORD structures */
	- memset(wr, 0, sizeof(wr));
	-@@ -874,15 +894,19 @@
	- if (s->compress != NULL)
	- maxcomplen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
	-
	-- /* write the header */
	-- if (!WPACKET_put_bytes_u8(thispkt, rectype)
	-+ /*
	-+ * When using offload kernel will write the header.
	-+ * Otherwise write the header now
	-+ */
	-+ if (!BIO_get_ktls_send(s->wbio)
	-+ && (!WPACKET_put_bytes_u8(thispkt, rectype)
	- \|\| !WPACKET_put_bytes_u16(thispkt, version)
	- \|\| !WPACKET_start_sub_packet_u16(thispkt)
	- \|\| (eivlen > 0
	- && !WPACKET_allocate_bytes(thispkt, eivlen, NULL))
	- \|\| (maxcomplen > 0
	- && !WPACKET_reserve_bytes(thispkt, maxcomplen,
	-- &compressdata))) {
	-+ &compressdata)))) {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	- ERR_R_INTERNAL_ERROR);
	- goto err;
	-@@ -908,15 +932,20 @@
	- goto err;
	- }
	- } else {
	-- if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
	-- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	-- ERR_R_INTERNAL_ERROR);
	-- goto err;
	-+ if (BIO_get_ktls_send(s->wbio)) {
	-+ SSL3_RECORD_reset_data(&wr[j]);
	-+ } else {
	-+ if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
	-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	-+ ERR_R_INTERNAL_ERROR);
	-+ goto err;
	-+ }
	-+ SSL3_RECORD_reset_input(&wr[j]);
	- }
	-- SSL3_RECORD_reset_input(&wr[j]);
	- }
	-
	- if (SSL_TREAT_AS_TLS13(s)
	-+ && !BIO_get_ktls_send(s->wbio)
	- && s->enc_write_ctx != NULL
	- && (s->statem.enc_write_state != ENC_WRITE_STATE_WRITE_PLAIN_ALERTS
	- \|\| type != SSL3_RT_ALERT)) {
	-@@ -972,7 +1001,7 @@
	- * in the wb->buf
	- */
	-
	-- if (!SSL_WRITE_ETM(s) && mac_size != 0) {
	-+ if (!BIO_get_ktls_send(s->wbio) && !SSL_WRITE_ETM(s) && mac_size != 0) {
	- unsigned char *mac;
	-
	- if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
	-@@ -989,26 +1018,27 @@
	- * max encrypted overhead does not need to include an allocation for that
	- * MAC
	- */
	-- if (!WPACKET_reserve_bytes(thispkt,
	-- SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
	-- - mac_size,
	-- NULL)
	-- /*
	-- * We also need next the amount of bytes written to this
	-- * sub-packet
	-- */
	-+ if (!BIO_get_ktls_send(s->wbio)) {
	-+ if (!WPACKET_reserve_bytes(thispkt,
	-+ SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
	-+ - mac_size,
	-+ NULL)
	-+ /*
	-+ * We also need next the amount of bytes written to this
	-+ * sub-packet
	-+ */
	- \|\| !WPACKET_get_length(thispkt, &len)) {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	- ERR_R_INTERNAL_ERROR);
	- goto err;
	-- }
	-+ }
	-
	-- /* Get a pointer to the start of this record excluding header */
	-- recordstart = WPACKET_get_curr(thispkt) - len;
	--
	-- SSL3_RECORD_set_data(thiswr, recordstart);
	-- SSL3_RECORD_reset_input(thiswr);
	-- SSL3_RECORD_set_length(thiswr, len);
	-+ /* Get a pointer to the start of this record excluding header */
	-+ recordstart = WPACKET_get_curr(thispkt) - len;
	-+ SSL3_RECORD_set_data(thiswr, recordstart);
	-+ SSL3_RECORD_reset_input(thiswr);
	-+ SSL3_RECORD_set_length(thiswr, len);
	-+ }
	- }
	-
	- if (s->statem.enc_write_state == ENC_WRITE_STATE_WRITE_PLAIN_ALERTS) {
	-@@ -1024,12 +1054,14 @@
	- goto err;
	- }
	- } else {
	-- if (s->method->ssl3_enc->enc(s, wr, numpipes, 1) < 1) {
	-- if (!ossl_statem_in_error(s)) {
	-- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	-- ERR_R_INTERNAL_ERROR);
	-+ if (!BIO_get_ktls_send(s->wbio)) {
	-+ if (s->method->ssl3_enc->enc(s, wr, numpipes, 1) < 1) {
	-+ if (!ossl_statem_in_error(s)) {
	-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	-+ ERR_R_INTERNAL_ERROR);
	-+ }
	-+ goto err;
	- }
	-- goto err;
	- }
	- }
	-
	-@@ -1039,6 +1071,9 @@
	- thispkt = &pkt[j];
	- thiswr = &wr[j];
	-
	-+ if (BIO_get_ktls_send(s->wbio))
	-+ goto mac_done;
	-+
	- /* Allocate bytes for the encryption overhead */
	- if (!WPACKET_get_length(thispkt, &origlen)
	- /* Check we allowed enough room for the encryption growth */
	-@@ -1048,7 +1083,8 @@
	- \|\| origlen > thiswr->length
	- \|\| (thiswr->length > origlen
	- && !WPACKET_allocate_bytes(thispkt,
	-- thiswr->length - origlen, NULL))) {
	-+ thiswr->length - origlen,
	-+ NULL))) {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
	- ERR_R_INTERNAL_ERROR);
	- goto err;
	-@@ -1093,13 +1129,8 @@
	- goto err;
	- }
	-
	-- /*
	-- * we should now have thiswr->data pointing to the encrypted data, which
	-- * is thiswr->length long
	-- */
	-- SSL3_RECORD_set_type(thiswr, type); /* not needed but helps for
	-- * debugging */
	-- SSL3_RECORD_add_length(thiswr, SSL3_RT_HEADER_LENGTH);
	-+ /* header is added by the kernel when using offload */
	-+ SSL3_RECORD_add_length(&wr[j], SSL3_RT_HEADER_LENGTH);
	-
	- if (create_empty_fragment) {
	- /*
	-@@ -1116,6 +1147,14 @@
	- return 1;
	- }
	-
	-+ mac_done:
	-+ /*
	-+ * we should now have thiswr->data pointing to the encrypted data, which
	-+ * is thiswr->length long
	-+ */
	-+ SSL3_RECORD_set_type(thiswr, type); /* not needed but helps for
	-+ * debugging */
	-+
	- /* now let's set up wb */
	- SSL3_BUFFER_set_left(&s->rlayer.wbuf[j],
	- prefix_len + SSL3_RECORD_get_length(thiswr));
	-@@ -1169,6 +1208,17 @@
	- clear_sys_error();
	- if (s->wbio != NULL) {
	- s->rwstate = SSL_WRITING;
	-+
	-+ /*
	-+ * To prevent coalescing of control and data messages,
	-+ * such as in buffer_write, we flush the BIO
	-+ */
	-+ if (BIO_get_ktls_send(s->wbio) && type != SSL3_RT_APPLICATION_DATA) {
	-+ i = BIO_flush(s->wbio);
	-+ if (i <= 0)
	-+ return i;
	-+ BIO_set_ktls_ctrl_msg(s->wbio, type);
	-+ }
	- /* TODO(size_t): Convert this call */
	- i = BIO_write(s->wbio, (char *)
	- &(SSL3_BUFFER_get_buf(&wb[currbuf])
	-@@ -1181,7 +1231,15 @@
	- SSL_R_BIO_NOT_SET);
	- i = -1;
	- }
	-- if (i > 0 && tmpwrit == SSL3_BUFFER_get_left(&wb[currbuf])) {
	-+
	-+ /*
	-+ * When an empty fragment is sent on a connection using KTLS,
	-+ * it is sent as a write of zero bytes. If this zero byte
	-+ * write succeeds, i will be 0 rather than a non-zero value.
	-+ * Treat i == 0 as success rather than an error for zero byte
	-+ * writes to permit this case.
	-+ */
	-+ if (i >= 0 && tmpwrit == SSL3_BUFFER_get_left(&wb[currbuf])) {
	- SSL3_BUFFER_set_left(&wb[currbuf], 0);
	- SSL3_BUFFER_add_offset(&wb[currbuf], tmpwrit);
	- if (currbuf + 1 < s->rlayer.numwpipes)
	-diff --git ssl/record/record.h ssl/record/record.h
	-index af56206e07..10fdde71a8 100644
	---- ssl/record/record.h
	-+++ ssl/record/record.h
	-@@ -25,6 +25,8 @@ typedef struct ssl3_buffer_st {
	- size_t offset;
	- /* how many bytes left */
	- size_t left;
	-+ /* 'buf' is from application for KTLS */
	-+ int app_buffer;
	- } SSL3_BUFFER;
	-
	- #define SEQ_NUM_SIZE 8
	-diff --git ssl/record/record_local.h ssl/record/record_local.h
	-index 5e8dd7f704..4760eeb7d8 100644
	---- ssl/record/record_local.h
	-+++ ssl/record/record_local.h
	-@@ -65,6 +65,8 @@ void dtls1_record_bitmap_update(SSL s, DTLS1_BITMAP bitmap);
	- #define SSL3_BUFFER_add_offset(b, o) ((b)->offset += (o))
	- #define SSL3_BUFFER_is_initialised(b) ((b)->buf != NULL)
	- #define SSL3_BUFFER_set_default_len(b, l) ((b)->default_len = (l))
	-+#define SSL3_BUFFER_set_app_buffer(b, l) ((b)->app_buffer = (l))
	-+#define SSL3_BUFFER_is_app_buffer(b) ((b)->app_buffer)
	-
	- void SSL3_BUFFER_clear(SSL3_BUFFER *b);
	- void SSL3_BUFFER_set_data(SSL3_BUFFER b, const unsigned char d, size_t n);
	-@@ -88,6 +90,7 @@ int ssl3_release_write_buffer(SSL *s);
	- #define SSL3_RECORD_get_input(r) ((r)->input)
	- #define SSL3_RECORD_set_input(r, i) ((r)->input = (i))
	- #define SSL3_RECORD_reset_input(r) ((r)->input = (r)->data)
	-+#define SSL3_RECORD_reset_data(r) ((r)->data = (r)->input)
	- #define SSL3_RECORD_get_seq_num(r) ((r)->seq_num)
	- #define SSL3_RECORD_get_off(r) ((r)->off)
	- #define SSL3_RECORD_set_off(r, o) ((r)->off = (o))
	-diff --git ssl/record/ssl3_buffer.c ssl/record/ssl3_buffer.c
	-index b9ba25e0c3..10d11ab76c 100644
	---- ssl/record/ssl3_buffer.c
	-+++ ssl/record/ssl3_buffer.c
	-@@ -110,23 +110,27 @@ int ssl3_setup_write_buffer(SSL *s, size_t numwpipes, size_t len)
	- for (currpipe = 0; currpipe < numwpipes; currpipe++) {
	- SSL3_BUFFER *thiswb = &wb[currpipe];
	-
	-- if (thiswb->buf != NULL && thiswb->len != len) {
	-+ if (thiswb->len != len) {
	- OPENSSL_free(thiswb->buf);
	- thiswb->buf = NULL; /* force reallocation */
	- }
	-
	- if (thiswb->buf == NULL) {
	-- p = OPENSSL_malloc(len);
	-- if (p == NULL) {
	-- s->rlayer.numwpipes = currpipe;
	-- /*
	-- * We've got a malloc failure, and we're still initialising
	-- * buffers. We assume we're so doomed that we won't even be able
	-- * to send an alert.
	-- */
	-- SSLfatal(s, SSL_AD_NO_ALERT,
	-- SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
	-- return 0;
	-+ if (s->wbio == NULL \|\| !BIO_get_ktls_send(s->wbio)) {
	-+ p = OPENSSL_malloc(len);
	-+ if (p == NULL) {
	-+ s->rlayer.numwpipes = currpipe;
	-+ /*
	-+ * We've got a malloc failure, and we're still initialising
	-+ * buffers. We assume we're so doomed that we won't even be able
	-+ * to send an alert.
	-+ */
	-+ SSLfatal(s, SSL_AD_NO_ALERT,
	-+ SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
	-+ return 0;
	-+ }
	-+ } else {
	-+ p = NULL;
	- }
	- memset(thiswb, 0, sizeof(SSL3_BUFFER));
	- thiswb->buf = p;
	-@@ -159,7 +163,10 @@ int ssl3_release_write_buffer(SSL *s)
	- while (pipes > 0) {
	- wb = &RECORD_LAYER_get_wbuf(&s->rlayer)[pipes - 1];
	-
	-- OPENSSL_free(wb->buf);
	-+ if (SSL3_BUFFER_is_app_buffer(wb))
	-+ SSL3_BUFFER_set_app_buffer(wb, 0);
	-+ else
	-+ OPENSSL_free(wb->buf);
	- wb->buf = NULL;
	- pipes--;
	- }
	-diff --git ssl/record/ssl3_record.c ssl/record/ssl3_record.c
	-index f158544789..da549995e0 100644
	---- ssl/record/ssl3_record.c
	-+++ ssl/record/ssl3_record.c
	-@@ -186,6 +186,7 @@ int ssl3_get_record(SSL *s)
	- size_t num_recs = 0, max_recs, j;
	- PACKET pkt, sslv2pkt;
	- size_t first_rec_len;
	-+ int using_ktls;
	-
	- rr = RECORD_LAYER_get_rrec(&s->rlayer);
	- rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
	-@@ -194,6 +195,12 @@ int ssl3_get_record(SSL *s)
	- max_recs = 1;
	- sess = s->session;
	-
	-+ /*
	-+ * KTLS reads full records. If there is any data left,
	-+ * then it is from before enabling ktls.
	-+ */
	-+ using_ktls = BIO_get_ktls_recv(s->rbio) && SSL3_BUFFER_get_left(rbuf) == 0;
	-+
	- do {
	- thisrr = &rr[num_recs];
	-
	-@@ -207,8 +214,32 @@ int ssl3_get_record(SSL *s)
	- rret = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,
	- SSL3_BUFFER_get_len(rbuf), 0,
	- num_recs == 0 ? 1 : 0, &n);
	-- if (rret <= 0)
	-- return rret; /* error or non-blocking */
	-+ if (rret <= 0) {
	-+#ifndef OPENSSL_NO_KTLS
	-+ if (!BIO_get_ktls_recv(s->rbio) \|\| rret == 0)
	-+ return rret; /* error or non-blocking */
	-+ switch (errno) {
	-+ case EBADMSG:
	-+ SSLfatal(s, SSL_AD_BAD_RECORD_MAC,
	-+ SSL_F_SSL3_GET_RECORD,
	-+ SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
	-+ break;
	-+ case EMSGSIZE:
	-+ SSLfatal(s, SSL_AD_RECORD_OVERFLOW,
	-+ SSL_F_SSL3_GET_RECORD,
	-+ SSL_R_PACKET_LENGTH_TOO_LONG);
	-+ break;
	-+ case EINVAL:
	-+ SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
	-+ SSL_F_SSL3_GET_RECORD,
	-+ SSL_R_WRONG_VERSION_NUMBER);
	-+ break;
	-+ default:
	-+ break;
	-+ }
	-+#endif
	-+ return rret;
	-+ }
	- RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
	-
	- p = RECORD_LAYER_get_packet(&s->rlayer);
	-@@ -339,7 +370,9 @@ int ssl3_get_record(SSL *s)
	- }
	- }
	-
	-- if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL) {
	-+ if (SSL_IS_TLS13(s)
	-+ && s->enc_read_ctx != NULL
	-+ && !using_ktls) {
	- if (thisrr->type != SSL3_RT_APPLICATION_DATA
	- && (thisrr->type != SSL3_RT_CHANGE_CIPHER_SPEC
	- \|\| !SSL_IS_FIRST_HANDSHAKE(s))
	-@@ -369,7 +402,13 @@ int ssl3_get_record(SSL *s)
	- }
	-
	- if (SSL_IS_TLS13(s)) {
	-- if (thisrr->length > SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH) {
	-+ size_t len = SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH;
	-+
	-+ /* KTLS strips the inner record type. */
	-+ if (using_ktls)
	-+ len = SSL3_RT_MAX_ENCRYPTED_LENGTH;
	-+
	-+ if (thisrr->length > len) {
	- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
	- SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
	- return -1;
	-@@ -386,6 +425,10 @@ int ssl3_get_record(SSL *s)
	- len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD;
	- #endif
	-
	-+ /* KTLS may use all of the buffer */
	-+ if (using_ktls)
	-+ len = SSL3_BUFFER_get_left(rbuf);
	-+
	- if (thisrr->length > len) {
	- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
	- SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
	-@@ -404,6 +447,7 @@ int ssl3_get_record(SSL *s)
	- } else {
	- more = thisrr->length;
	- }
	-+
	- if (more > 0) {
	- /* now s->rlayer.packet_length == SSL3_RT_HEADER_LENGTH */
	-
	-@@ -491,6 +535,9 @@ int ssl3_get_record(SSL *s)
	- return 1;
	- }
	-
	-+ if (using_ktls)
	-+ goto skip_decryption;
	-+
	- /*
	- * If in encrypt-then-mac mode calculate mac from encrypted record. All
	- * the details below are public so no timing details can leak.
	-@@ -678,6 +725,8 @@ int ssl3_get_record(SSL *s)
	- return -1;
	- }
	-
	-+ skip_decryption:
	-+
	- for (j = 0; j < num_recs; j++) {
	- thisrr = &rr[j];
	-
	-@@ -698,22 +747,30 @@ int ssl3_get_record(SSL *s)
	- if (SSL_IS_TLS13(s)
	- && s->enc_read_ctx != NULL
	- && thisrr->type != SSL3_RT_ALERT) {
	-- size_t end;
	-+ /*
	-+ * The following logic are irrelevant in KTLS: the kernel provides
	-+ * unprotected record and thus record type represent the actual
	-+ * content type, and padding is already removed and thisrr->type and
	-+ * thisrr->length should have the correct values.
	-+ */
	-+ if (!using_ktls) {
	-+ size_t end;
	-
	-- if (thisrr->length == 0
	-- \|\| thisrr->type != SSL3_RT_APPLICATION_DATA) {
	-- SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_SSL3_GET_RECORD,
	-- SSL_R_BAD_RECORD_TYPE);
	-- return -1;
	-+ if (thisrr->length == 0
	-+ \|\| thisrr->type != SSL3_RT_APPLICATION_DATA) {
	-+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
	-+ SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);
	-+ return -1;
	-+ }
	-+
	-+ /* Strip trailing padding */
	-+ for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;
	-+ end--)
	-+ continue;
	-+
	-+ thisrr->length = end;
	-+ thisrr->type = thisrr->data[end];
	- }
	--
	-- /* Strip trailing padding */
	-- for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;
	-- end--)
	-- continue;
	--
	-- thisrr->length = end;
	-- thisrr->type = thisrr->data[end];
	- if (thisrr->type != SSL3_RT_APPLICATION_DATA
	- && thisrr->type != SSL3_RT_ALERT
	- && thisrr->type != SSL3_RT_HANDSHAKE) {
	-@@ -723,7 +780,7 @@ int ssl3_get_record(SSL *s)
	- }
	- if (s->msg_callback)
	- s->msg_callback(0, s->version, SSL3_RT_INNER_CONTENT_TYPE,
	-- &thisrr->data[end], 1, s, s->msg_callback_arg);
	-+ &thisrr->type, 1, s, s->msg_callback_arg);
	- }
	-
	- /*
	-@@ -739,13 +796,25 @@ int ssl3_get_record(SSL *s)
	- return -1;
	- }
	-
	-- if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
	-+ /*
	-+ * Usually thisrr->length is the length of a single record, but when
	-+ * KTLS handles the decryption, thisrr->length may be larger than
	-+ * SSL3_RT_MAX_PLAIN_LENGTH because the kernel may have coalesced
	-+ * multiple records.
	-+ * Therefore we have to rely on KTLS to check the plaintext length
	-+ * limit in the kernel.
	-+ */
	-+ if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH && !using_ktls) {
	- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
	- SSL_R_DATA_LENGTH_TOO_LONG);
	- return -1;
	- }
	-
	-- /* If received packet overflows current Max Fragment Length setting */
	-+ /*
	-+ * Check if the received packet overflows the current
	-+ * Max Fragment Length setting.
	-+ * Note: USE_MAX_FRAGMENT_LENGTH_EXT and KTLS are mutually exclusive.
	-+ */
	- if (s->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)
	- && thisrr->length > GET_MAX_FRAGMENT_LENGTH(s->session)) {
	- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
	-diff --git ssl/ssl_conf.c ssl/ssl_conf.c
	-index 0a3fef7c8c..8013c62f07 100644
	---- ssl/ssl_conf.c
	-+++ ssl/ssl_conf.c
	-@@ -391,7 +391,8 @@ static int cmd_Options(SSL_CONF_CTX cctx, const char value)
	- SSL_FLAG_TBL("AllowNoDHEKEX", SSL_OP_ALLOW_NO_DHE_KEX),
	- SSL_FLAG_TBL("PrioritizeChaCha", SSL_OP_PRIORITIZE_CHACHA),
	- SSL_FLAG_TBL("MiddleboxCompat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT),
	-- SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY)
	-+ SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY),
	-+ SSL_FLAG_TBL("KTLS", SSL_OP_ENABLE_KTLS)
	- };
	- if (value == NULL)
	- return -3;
	-diff --git ssl/ssl_err.c ssl/ssl_err.c
	-index 324f2ccbb0..03273204ee 100644
	---- ssl/ssl_err.c
	-+++ ssl/ssl_err.c
	-@@ -313,6 +313,7 @@ static const ERR_STRING_DATA SSL_str_functs[] = {
	- "SSL_renegotiate_abbreviated"},
	- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT, 0), ""},
	- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, 0), ""},
	-+ {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SENDFILE, 0), "SSL_sendfile"},
	- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_DUP, 0), "ssl_session_dup"},
	- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_NEW, 0), "SSL_SESSION_new"},
	- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_PRINT_FP, 0),
	-diff --git ssl/ssl_lib.c ssl/ssl_lib.c
	-index 25a1a44785..1fbad29b23 100644
	---- ssl/ssl_lib.c
	-+++ ssl/ssl_lib.c
	-@@ -11,6 +11,7 @@
	-
	- #include <stdio.h>
	- #include "ssl_local.h"
	-+#include "e_os.h"
	- #include <openssl/objects.h>
	- #include <openssl/x509v3.h>
	- #include <openssl/rand.h>
	-@@ -22,6 +23,7 @@
	- #include <openssl/ct.h>
	- #include "internal/cryptlib.h"
	- #include "internal/refcount.h"
	-+#include "internal/ktls.h"
	-
	- const char SSL_version_str[] = OPENSSL_VERSION_TEXT;
	-
	-@@ -1159,11 +1161,15 @@ void SSL_free(SSL *s)
	- dane_final(&s->dane);
	- CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
	-
	-+ RECORD_LAYER_release(&s->rlayer);
	-+
	- /* Ignore return value */
	- ssl_free_wbio_buffer(s);
	-
	- BIO_free_all(s->wbio);
	-+ s->wbio = NULL;
	- BIO_free_all(s->rbio);
	-+ s->rbio = NULL;
	-
	- BUF_MEM_free(s->init_buf);
	-
	-@@ -1220,8 +1226,6 @@ void SSL_free(SSL *s)
	- if (s->method != NULL)
	- s->method->ssl_free(s);
	-
	-- RECORD_LAYER_release(&s->rlayer);
	--
	- SSL_CTX_free(s->ctx);
	-
	- ASYNC_WAIT_CTX_free(s->waitctx);
	-@@ -1361,6 +1365,15 @@ int SSL_set_fd(SSL *s, int fd)
	- }
	- BIO_set_fd(bio, fd, BIO_NOCLOSE);
	- SSL_set_bio(s, bio, bio);
	-+#ifndef OPENSSL_NO_KTLS
	-+ /*
	-+ * The new socket is created successfully regardless of ktls_enable.
	-+ * ktls_enable doesn't change any functionality of the socket, except
	-+ * changing the setsockopt to enable the processing of ktls_start.
	-+ * Thus, it is not a problem to call it for non-TLS sockets.
	-+ */
	-+ ktls_enable(fd);
	-+#endif /* OPENSSL_NO_KTLS */
	- ret = 1;
	- err:
	- return ret;
	-@@ -1380,6 +1393,15 @@ int SSL_set_wfd(SSL *s, int fd)
	- }
	- BIO_set_fd(bio, fd, BIO_NOCLOSE);
	- SSL_set0_wbio(s, bio);
	-+#ifndef OPENSSL_NO_KTLS
	-+ /*
	-+ * The new socket is created successfully regardless of ktls_enable.
	-+ * ktls_enable doesn't change any functionality of the socket, except
	-+ * changing the setsockopt to enable the processing of ktls_start.
	-+ * Thus, it is not a problem to call it for non-TLS sockets.
	-+ */
	-+ ktls_enable(fd);
	-+#endif /* OPENSSL_NO_KTLS */
	- } else {
	- BIO_up_ref(rbio);
	- SSL_set0_wbio(s, rbio);
	-@@ -1963,6 +1985,70 @@ int ssl_write_internal(SSL s, const void buf, size_t num, size_t *written)
	- }
	- }
	-
	-+ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
	-+{
	-+ ossl_ssize_t ret;
	-+
	-+ if (s->handshake_func == NULL) {
	-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
	-+ return -1;
	-+ }
	-+
	-+ if (s->shutdown & SSL_SENT_SHUTDOWN) {
	-+ s->rwstate = SSL_NOTHING;
	-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_PROTOCOL_IS_SHUTDOWN);
	-+ return -1;
	-+ }
	-+
	-+ if (!BIO_get_ktls_send(s->wbio)) {
	-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
	-+ return -1;
	-+ }
	-+
	-+ /* If we have an alert to send, lets send it */
	-+ if (s->s3->alert_dispatch) {
	-+ ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
	-+ if (ret <= 0) {
	-+ /* SSLfatal() already called if appropriate */
	-+ return ret;
	-+ }
	-+ /* if it went, fall through and send more stuff */
	-+ }
	-+
	-+ s->rwstate = SSL_WRITING;
	-+ if (BIO_flush(s->wbio) <= 0) {
	-+ if (!BIO_should_retry(s->wbio)) {
	-+ s->rwstate = SSL_NOTHING;
	-+ } else {
	-+#ifdef EAGAIN
	-+ set_sys_error(EAGAIN);
	-+#endif
	-+ }
	-+ return -1;
	-+ }
	-+
	-+#ifdef OPENSSL_NO_KTLS
	-+ SYSerr(SSL_F_SSL_SENDFILE, ERR_R_INTERNAL_ERROR);
	-+ ERR_add_error_data(1, "calling sendfile()");
	-+ return -1;
	-+#else
	-+ ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
	-+ if (ret < 0) {
	-+#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
	-+ if ((get_last_sys_error() == EAGAIN) \|\|
	-+ (get_last_sys_error() == EINTR) \|\|
	-+ (get_last_sys_error() == EBUSY))
	-+ BIO_set_retry_write(s->wbio);
	-+ else
	-+#endif
	-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
	-+ return ret;
	-+ }
	-+ s->rwstate = SSL_NOTHING;
	-+ return ret;
	-+#endif
	-+}
	-+
	- int SSL_write(SSL s, const void buf, int num)
	- {
	- int ret;
	-@@ -2213,6 +2299,10 @@ long SSL_ctrl(SSL s, int cmd, long larg, void parg)
	- case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
	- if (larg < 512 \|\| larg > SSL3_RT_MAX_PLAIN_LENGTH)
	- return 0;
	-+#ifndef OPENSSL_NO_KTLS
	-+ if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
	-+ return 0;
	-+#endif /* OPENSSL_NO_KTLS */
	- s->max_send_fragment = larg;
	- if (s->max_send_fragment < s->split_send_fragment)
	- s->split_send_fragment = s->max_send_fragment;
	-@@ -4471,11 +4561,18 @@ int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
	- return 1;
	- }
	-
	--void SSL_set_record_padding_callback(SSL *ssl,
	-+int SSL_set_record_padding_callback(SSL *ssl,
	- size_t (cb) (SSL ssl, int type,
	- size_t len, void *arg))
	- {
	-- ssl->record_padding_cb = cb;
	-+ BIO *b;
	-+
	-+ b = SSL_get_wbio(ssl);
	-+ if (b == NULL \|\| !BIO_get_ktls_send(b)) {
	-+ ssl->record_padding_cb = cb;
	-+ return 1;
	-+ }
	-+ return 0;
	- }
	-
	- void SSL_set_record_padding_callback_arg(SSL ssl, void arg)
	-diff --git ssl/ssl_local.h ssl/ssl_local.h
	-index 9f346e30e8..587064cc18 100644
	---- ssl/ssl_local.h
	-+++ ssl/ssl_local.h
	-@@ -34,6 +34,8 @@
	- # include "internal/dane.h"
	- # include "internal/refcount.h"
	- # include "internal/tsan_assist.h"
	-+# include "internal/bio.h"
	-+# include "internal/ktls.h"
	-
	- # ifdef OPENSSL_BUILD_SHLIBSSL
	- # undef OPENSSL_EXTERN
	-@@ -2617,6 +2619,17 @@ __owur int ssl_log_secret(SSL ssl, const char label,
	- #define EARLY_EXPORTER_SECRET_LABEL "EARLY_EXPORTER_SECRET"
	- #define EXPORTER_SECRET_LABEL "EXPORTER_SECRET"
	-
	-+# ifndef OPENSSL_NO_KTLS
	-+/* ktls.c */
	-+int ktls_check_supported_cipher(const SSL s, const EVP_CIPHER c,
	-+ const EVP_CIPHER_CTX *dd);
	-+int ktls_configure_crypto(SSL s, const EVP_CIPHER c, EVP_CIPHER_CTX *dd,
	-+ void rl_sequence, ktls_crypto_info_t crypto_info,
	-+ int is_tx, unsigned char *iv,
	-+ unsigned char key, unsigned char mac_key,
	-+ size_t mac_secret_size);
	-+# endif
	-+
	- /* s3_cbc.c */
	- __owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
	- __owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
	-diff --git ssl/t1_enc.c ssl/t1_enc.c
	-index f8e53d4efc..46191908ab 100644
	---- ssl/t1_enc.c
	-+++ ssl/t1_enc.c
	-@@ -10,10 +10,14 @@
	-
	- #include <stdio.h>
	- #include "ssl_local.h"
	-+#include "record/record_local.h"
	-+#include "internal/ktls.h"
	-+#include "internal/cryptlib.h"
	- #include <openssl/comp.h>
	- #include <openssl/evp.h>
	- #include <openssl/kdf.h>
	- #include <openssl/rand.h>
	-+#include <openssl/obj_mac.h>
	-
	- /* seed1 through seed5 are concatenated */
	- static int tls1_PRF(SSL *s,
	-@@ -94,6 +98,11 @@ int tls1_change_cipher_state(SSL *s, int which)
	- EVP_PKEY *mac_key;
	- size_t n, i, j, k, cl;
	- int reuse_dd = 0;
	-+#ifndef OPENSSL_NO_KTLS
	-+ ktls_crypto_info_t crypto_info;
	-+ void *rl_sequence;
	-+ BIO *bio;
	-+#endif
	-
	- c = s->s3->tmp.new_sym_enc;
	- m = s->s3->tmp.new_hash;
	-@@ -312,6 +321,62 @@ int tls1_change_cipher_state(SSL *s, int which)
	- ERR_R_INTERNAL_ERROR);
	- goto err;
	- }
	-+#ifndef OPENSSL_NO_KTLS
	-+ if (s->compress \|\| (s->options & SSL_OP_ENABLE_KTLS) == 0)
	-+ goto skip_ktls;
	-+
	-+ /* ktls supports only the maximum fragment size */
	-+ if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH)
	-+ goto skip_ktls;
	-+
	-+ /* check that cipher is supported */
	-+ if (!ktls_check_supported_cipher(s, c, dd))
	-+ goto skip_ktls;
	-+
	-+ if (which & SSL3_CC_WRITE)
	-+ bio = s->wbio;
	-+ else
	-+ bio = s->rbio;
	-+
	-+ if (!ossl_assert(bio != NULL)) {
	-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE,
	-+ ERR_R_INTERNAL_ERROR);
	-+ goto err;
	-+ }
	-+
	-+ /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
	-+ if (which & SSL3_CC_WRITE) {
	-+ if (BIO_flush(bio) <= 0)
	-+ goto skip_ktls;
	-+ }
	-+
	-+ /* ktls doesn't support renegotiation */
	-+ if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) \|\|
	-+ (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) {
	-+ SSLfatal(s, SSL_AD_NO_RENEGOTIATION, SSL_F_TLS1_CHANGE_CIPHER_STATE,
	-+ ERR_R_INTERNAL_ERROR);
	-+ goto err;
	-+ }
	-+
	-+ if (which & SSL3_CC_WRITE)
	-+ rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
	-+ else
	-+ rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
	-+
	-+ if (!ktls_configure_crypto(s, c, dd, rl_sequence, &crypto_info,
	-+ which & SSL3_CC_WRITE, iv, key, ms,
	-+ *mac_secret_size))
	-+ goto skip_ktls;
	-+
	-+ /* ktls works with user provided buffers directly */
	-+ if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
	-+ if (which & SSL3_CC_WRITE)
	-+ ssl3_release_write_buffer(s);
	-+ SSL_set_options(s, SSL_OP_NO_RENEGOTIATION);
	-+ }
	-+
	-+ skip_ktls:
	-+#endif /* OPENSSL_NO_KTLS */
	- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
	-
	- #ifdef SSL_DEBUG
	-diff --git ssl/tls13_enc.c ssl/tls13_enc.c
	-index b8fb07f210..109227e556 100644
	---- ssl/tls13_enc.c
	-+++ ssl/tls13_enc.c
	-@@ -9,6 +9,8 @@
	-
	- #include <stdlib.h>
	- #include "ssl_local.h"
	-+#include "internal/ktls.h"
	-+#include "record/record_local.h"
	- #include "internal/cryptlib.h"
	- #include <openssl/evp.h>
	- #include <openssl/kdf.h>
	-@@ -363,9 +365,9 @@ static int derive_secret_key_and_iv(SSL s, int sending, const EVP_MD md,
	- const unsigned char *hash,
	- const unsigned char *label,
	- size_t labellen, unsigned char *secret,
	-- unsigned char iv, EVP_CIPHER_CTX ciph_ctx)
	-+ unsigned char key, unsigned char iv,
	-+ EVP_CIPHER_CTX *ciph_ctx)
	- {
	-- unsigned char key[EVP_MAX_KEY_LENGTH];
	- size_t ivlen, keylen, taglen;
	- int hashleni = EVP_MD_size(md);
	- size_t hashlen;
	-@@ -374,14 +376,14 @@ static int derive_secret_key_and_iv(SSL s, int sending, const EVP_MD md,
	- if (!ossl_assert(hashleni >= 0)) {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
	- ERR_R_EVP_LIB);
	-- goto err;
	-+ return 0;
	- }
	- hashlen = (size_t)hashleni;
	-
	- if (!tls13_hkdf_expand(s, md, insecret, label, labellen, hash, hashlen,
	- secret, hashlen, 1)) {
	- /* SSLfatal() already called */
	-- goto err;
	-+ return 0;
	- }
	-
	- /* TODO(size_t): convert me */
	-@@ -401,7 +403,7 @@ static int derive_secret_key_and_iv(SSL s, int sending, const EVP_MD md,
	- } else {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
	- ERR_R_EVP_LIB);
	-- goto err;
	-+ return 0;
	- }
	- if (algenc & (SSL_AES128CCM8 \| SSL_AES256CCM8))
	- taglen = EVP_CCM8_TLS_TAG_LEN;
	-@@ -415,7 +417,7 @@ static int derive_secret_key_and_iv(SSL s, int sending, const EVP_MD md,
	- if (!tls13_derive_key(s, md, secret, key, keylen)
	- \|\| !tls13_derive_iv(s, md, secret, iv, ivlen)) {
	- /* SSLfatal() already called */
	-- goto err;
	-+ return 0;
	- }
	-
	- if (EVP_CipherInit_ex(ciph_ctx, ciph, NULL, NULL, NULL, sending) <= 0
	-@@ -425,13 +427,10 @@ static int derive_secret_key_and_iv(SSL s, int sending, const EVP_MD md,
	- \|\| EVP_CipherInit_ex(ciph_ctx, NULL, NULL, key, NULL, -1) <= 0) {
	- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
	- ERR_R_EVP_LIB);
	-- goto err;
	-+ return 0;
	- }
	-
	- return 1;
	-- err:
	-- OPENSSL_cleanse(key, sizeof(key));
	-- return 0;
	- }
	-
	- int tls13_change_cipher_state(SSL *s, int which)
	-@@ -456,6 +455,7 @@ int tls13_change_cipher_state(SSL *s, int which)
	- static const unsigned char early_exporter_master_secret[] = "e exp master";
	- #endif
	- unsigned char *iv;
	-+ unsigned char key[EVP_MAX_KEY_LENGTH];
	- unsigned char secret[EVP_MAX_MD_SIZE];
	- unsigned char hashval[EVP_MAX_MD_SIZE];
	- unsigned char *hash = hashval;
	-@@ -469,6 +469,11 @@ int tls13_change_cipher_state(SSL *s, int which)
	- int ret = 0;
	- const EVP_MD *md = NULL;
	- const EVP_CIPHER *cipher = NULL;
	-+#if !defined(OPENSSL_NO_KTLS) && defined(OPENSSL_KTLS_TLS13)
	-+ ktls_crypto_info_t crypto_info;
	-+ void *rl_sequence;
	-+ BIO *bio;
	-+#endif
	-
	- if (which & SSL3_CC_READ) {
	- if (s->enc_read_ctx != NULL) {
	-@@ -671,9 +676,13 @@ int tls13_change_cipher_state(SSL *s, int which)
	- }
	- }
	-
	-+ /* check whether cipher is known */
	-+ if(!ossl_assert(cipher != NULL))
	-+ goto err;
	-+
	- if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
	-- insecret, hash, label, labellen, secret, iv,
	-- ciph_ctx)) {
	-+ insecret, hash, label, labellen, secret, key,
	-+ iv, ciph_ctx)) {
	- /* SSLfatal() already called */
	- goto err;
	- }
	-@@ -714,8 +723,62 @@ int tls13_change_cipher_state(SSL *s, int which)
	- s->statem.enc_write_state = ENC_WRITE_STATE_WRITE_PLAIN_ALERTS;
	- else
	- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
	-+#ifndef OPENSSL_NO_KTLS
	-+# if defined(OPENSSL_KTLS_TLS13)
	-+ if (!(which & SSL3_CC_APPLICATION)
	-+ \|\| (s->options & SSL_OP_ENABLE_KTLS) == 0)
	-+ goto skip_ktls;
	-+
	-+ /* ktls supports only the maximum fragment size */
	-+ if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH)
	-+ goto skip_ktls;
	-+
	-+ /* ktls does not support record padding */
	-+ if (s->record_padding_cb != NULL)
	-+ goto skip_ktls;
	-+
	-+ /* check that cipher is supported */
	-+ if (!ktls_check_supported_cipher(s, cipher, ciph_ctx))
	-+ goto skip_ktls;
	-+
	-+ if (which & SSL3_CC_WRITE)
	-+ bio = s->wbio;
	-+ else
	-+ bio = s->rbio;
	-+
	-+ if (!ossl_assert(bio != NULL)) {
	-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_CHANGE_CIPHER_STATE,
	-+ ERR_R_INTERNAL_ERROR);
	-+ goto err;
	-+ }
	-+
	-+ /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
	-+ if (which & SSL3_CC_WRITE) {
	-+ if (BIO_flush(bio) <= 0)
	-+ goto skip_ktls;
	-+ }
	-+
	-+ /* configure kernel crypto structure */
	-+ if (which & SSL3_CC_WRITE)
	-+ rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
	-+ else
	-+ rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
	-+
	-+ if (!ktls_configure_crypto(s, cipher, ciph_ctx, rl_sequence, &crypto_info,
	-+ which & SSL3_CC_WRITE, iv, key, NULL, 0))
	-+ goto skip_ktls;
	-+
	-+ /* ktls works with user provided buffers directly */
	-+ if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
	-+ if (which & SSL3_CC_WRITE)
	-+ ssl3_release_write_buffer(s);
	-+ }
	-+skip_ktls:
	-+# endif
	-+#endif
	- ret = 1;
	- err:
	-+ OPENSSL_cleanse(key, sizeof(key));
	- OPENSSL_cleanse(secret, sizeof(secret));
	- return ret;
	- }
	-@@ -729,6 +792,7 @@ int tls13_update_key(SSL *s, int sending)
	- #endif
	- const EVP_MD *md = ssl_handshake_md(s);
	- size_t hashlen = EVP_MD_size(md);
	-+ unsigned char key[EVP_MAX_KEY_LENGTH];
	- unsigned char insecret, iv;
	- unsigned char secret[EVP_MAX_MD_SIZE];
	- EVP_CIPHER_CTX *ciph_ctx;
	-@@ -753,8 +817,8 @@ int tls13_update_key(SSL *s, int sending)
	- if (!derive_secret_key_and_iv(s, sending, ssl_handshake_md(s),
	- s->s3->tmp.new_sym_enc, insecret, NULL,
	- application_traffic,
	-- sizeof(application_traffic) - 1, secret, iv,
	-- ciph_ctx)) {
	-+ sizeof(application_traffic) - 1, secret, key,
	-+ iv, ciph_ctx)) {
	- /* SSLfatal() already called */
	- goto err;
	- }
	-@@ -764,6 +828,7 @@ int tls13_update_key(SSL *s, int sending)
	- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
	- ret = 1;
	- err:
	-+ OPENSSL_cleanse(key, sizeof(key));
	- OPENSSL_cleanse(secret, sizeof(secret));
	- return ret;
	- }
	-diff --git test/build.info test/build.info
	-index 6357a7f2fe..3b8d5ee765 100644
	---- test/build.info
	-+++ test/build.info
	-@@ -546,7 +546,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
	- # We disable this test completely in a shared build because it deliberately
	- # redefines some internal libssl symbols. This doesn't work in a non-shared
	- # build
	-- IF[{- !$disabled{shared} -}]
	-+ IF[{- !$disabled{shared} && $disabled{ktls} -}]
	- PROGRAMS_NO_INST=tls13secretstest
	- SOURCE[tls13secretstest]=tls13secretstest.c
	- SOURCE[tls13secretstest]= ../ssl/tls13_enc.c ../ssl/packet.c
	-diff --git test/recipes/80-test_ssl_old.t test/recipes/80-test_ssl_old.t
	-index 19772f61ef..f3cfda0507 100644
	---- test/recipes/80-test_ssl_old.t
	-+++ test/recipes/80-test_ssl_old.t
	-@@ -327,11 +327,9 @@ sub testssl {
	- }
	-
	-
	-- # plan tests => 11;
	--
	- subtest 'standard SSL tests' => sub {
	-- ######################################################################
	-- plan tests => 13;
	-+ ######################################################################
	-+ plan tests => 19;
	-
	- SKIP: {
	- skip "SSLv3 is not supported by this OpenSSL build", 4
	-@@ -356,8 +354,8 @@ sub testssl {
	- }
	-
	- SKIP: {
	-- skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 8
	-- if $no_anytls;
	-+ skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 14
	-+ if $no_anytls;
	-
	- SKIP: {
	- skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert;
	-@@ -378,17 +376,29 @@ sub testssl {
	- 'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify');
	-
	- SKIP: {
	-- skip "No IPv4 available on this machine", 1
	-+ skip "No IPv4 available on this machine", 4
	- unless !disabled("sock") && have_IPv4();
	- ok(run(test([@ssltest, "-ipv4"])),
	- 'test TLS via IPv4');
	-+ ok(run(test([@ssltest, "-ipv4", "-client_ktls"])),
	-+ 'test TLS via IPv4 + ktls(client)');
	-+ ok(run(test([@ssltest, "-ipv4", "-server_ktls"])),
	-+ 'test TLS via IPv4 + ktls(server)');
	-+ ok(run(test([@ssltest, "-ipv4", "-client_ktls", "-server_ktls"])),
	-+ 'test TLS via IPv4 + ktls');
	- }
	-
	- SKIP: {
	-- skip "No IPv6 available on this machine", 1
	-+ skip "No IPv6 available on this machine", 4
	- unless !disabled("sock") && have_IPv6();
	- ok(run(test([@ssltest, "-ipv6"])),
	- 'test TLS via IPv6');
	-+ ok(run(test([@ssltest, "-ipv6", "-client_ktls"])),
	-+ 'test TLS via IPv6 + ktls(client)');
	-+ ok(run(test([@ssltest, "-ipv6", "-server_ktls"])),
	-+ 'test TLS via IPv6 + ktls(client)');
	-+ ok(run(test([@ssltest, "-ipv6", "-client_ktls", "-server_ktls"])),
	-+ 'test TLS via IPv6 + ktls');
	- }
	- }
	- };
	-diff --git test/recipes/90-test_tls13secrets.t test/recipes/90-test_tls13secrets.t
	-index 5490885309..3478e540ed 100644
	---- test/recipes/90-test_tls13secrets.t
	-+++ test/recipes/90-test_tls13secrets.t
	-@@ -13,7 +13,7 @@ my $test_name = "tls13secrets";
	- setup($test_name);
	-
	- plan skip_all => "$test_name is not supported in this build"
	-- if disabled("tls1_3") \|\| disabled("shared");
	-+ if disabled("tls1_3") \|\| disabled("shared") \|\| !disabled("ktls");
	-
	- plan tests => 1;
	-
	-diff --git test/sslapitest.c test/sslapitest.c
	-index 6b5d9449a0..47ba76f0a5 100644
	---- test/sslapitest.c
	-+++ test/sslapitest.c
	-@@ -7,6 +7,7 @@
	- * https://www.openssl.org/source/license.html
	- */
	-
	-+#include <stdio.h>
	- #include <string.h>
	-
	- #include <openssl/opensslconf.h>
	-@@ -17,12 +18,14 @@
	- #include <openssl/srp.h>
	- #include <openssl/txt_db.h>
	- #include <openssl/aes.h>
	-+#include <openssl/rand.h>
	- #include <openssl/x509v3.h>
	-
	- #include "ssltestlib.h"
	- #include "testutil.h"
	- #include "testutil/output.h"
	- #include "internal/nelem.h"
	-+#include "internal/ktls.h"
	- #include "../ssl/ssl_local.h"
	-
	- #ifndef OPENSSL_NO_TLS1_3
	-@@ -780,6 +783,433 @@ static int execute_test_large_message(const SSL_METHOD *smeth,
	- return testresult;
	- }
	-
	-+#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_KTLS) && \
	-+ !(defined(OPENSSL_NO_TLS1_3) && defined(OPENSSL_NO_TLS1_2))
	-+/* sock must be connected */
	-+static int ktls_chk_platform(int sock)
	-+{
	-+ if (!ktls_enable(sock))
	-+ return 0;
	-+ return 1;
	-+}
	-+
	-+static int ping_pong_query(SSL clientssl, SSL serverssl)
	-+{
	-+ static char count = 1;
	-+ unsigned char cbuf[16000] = {0};
	-+ unsigned char sbuf[16000];
	-+ size_t err = 0;
	-+ char crec_wseq_before[SEQ_NUM_SIZE];
	-+ char crec_wseq_after[SEQ_NUM_SIZE];
	-+ char crec_rseq_before[SEQ_NUM_SIZE];
	-+ char crec_rseq_after[SEQ_NUM_SIZE];
	-+ char srec_wseq_before[SEQ_NUM_SIZE];
	-+ char srec_wseq_after[SEQ_NUM_SIZE];
	-+ char srec_rseq_before[SEQ_NUM_SIZE];
	-+ char srec_rseq_after[SEQ_NUM_SIZE];
	-+
	-+ cbuf[0] = count++;
	-+ memcpy(crec_wseq_before, &clientssl->rlayer.write_sequence, SEQ_NUM_SIZE);
	-+ memcpy(crec_rseq_before, &clientssl->rlayer.read_sequence, SEQ_NUM_SIZE);
	-+ memcpy(srec_wseq_before, &serverssl->rlayer.write_sequence, SEQ_NUM_SIZE);
	-+ memcpy(srec_rseq_before, &serverssl->rlayer.read_sequence, SEQ_NUM_SIZE);
	-+
	-+ if (!TEST_true(SSL_write(clientssl, cbuf, sizeof(cbuf)) == sizeof(cbuf)))
	-+ goto end;
	-+
	-+ while ((err = SSL_read(serverssl, &sbuf, sizeof(sbuf))) != sizeof(sbuf)) {
	-+ if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_READ) {
	-+ goto end;
	-+ }
	-+ }
	-+
	-+ if (!TEST_true(SSL_write(serverssl, sbuf, sizeof(sbuf)) == sizeof(sbuf)))
	-+ goto end;
	-+
	-+ while ((err = SSL_read(clientssl, &cbuf, sizeof(cbuf))) != sizeof(cbuf)) {
	-+ if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ) {
	-+ goto end;
	-+ }
	-+ }
	-+
	-+ memcpy(crec_wseq_after, &clientssl->rlayer.write_sequence, SEQ_NUM_SIZE);
	-+ memcpy(crec_rseq_after, &clientssl->rlayer.read_sequence, SEQ_NUM_SIZE);
	-+ memcpy(srec_wseq_after, &serverssl->rlayer.write_sequence, SEQ_NUM_SIZE);
	-+ memcpy(srec_rseq_after, &serverssl->rlayer.read_sequence, SEQ_NUM_SIZE);
	-+
	-+ /* verify the payload */
	-+ if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
	-+ goto end;
	-+
	-+ /*
	-+ * If ktls is used then kernel sequences are used instead of
	-+ * OpenSSL sequences
	-+ */
	-+ if (!BIO_get_ktls_send(clientssl->wbio)) {
	-+ if (!TEST_mem_ne(crec_wseq_before, SEQ_NUM_SIZE,
	-+ crec_wseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_mem_eq(crec_wseq_before, SEQ_NUM_SIZE,
	-+ crec_wseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ }
	-+
	-+ if (!BIO_get_ktls_send(serverssl->wbio)) {
	-+ if (!TEST_mem_ne(srec_wseq_before, SEQ_NUM_SIZE,
	-+ srec_wseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_mem_eq(srec_wseq_before, SEQ_NUM_SIZE,
	-+ srec_wseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ }
	-+
	-+ if (!BIO_get_ktls_recv(clientssl->wbio)) {
	-+ if (!TEST_mem_ne(crec_rseq_before, SEQ_NUM_SIZE,
	-+ crec_rseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_mem_eq(crec_rseq_before, SEQ_NUM_SIZE,
	-+ crec_rseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ }
	-+
	-+ if (!BIO_get_ktls_recv(serverssl->wbio)) {
	-+ if (!TEST_mem_ne(srec_rseq_before, SEQ_NUM_SIZE,
	-+ srec_rseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_mem_eq(srec_rseq_before, SEQ_NUM_SIZE,
	-+ srec_rseq_after, SEQ_NUM_SIZE))
	-+ goto end;
	-+ }
	-+
	-+ return 1;
	-+end:
	-+ return 0;
	-+}
	-+
	-+static int execute_test_ktls(int cis_ktls, int sis_ktls,
	-+ int tls_version, const char *cipher)
	-+{
	-+ SSL_CTX cctx = NULL, sctx = NULL;
	-+ SSL clientssl = NULL, serverssl = NULL;
	-+ int ktls_used = 0, testresult = 0;
	-+ int cfd = -1, sfd = -1;
	-+ int rx_supported;
	-+
	-+ if (!TEST_true(create_test_sockets(&cfd, &sfd)))
	-+ goto end;
	-+
	-+ /* Skip this test if the platform does not support ktls */
	-+ if (!ktls_chk_platform(cfd)) {
	-+ TEST_info("Kernel does not support KTLS");
	-+ testresult = 1;
	-+ goto end;
	-+ }
	-+
	-+ /* Create a session based on SHA-256 */
	-+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
	-+ TLS_client_method(),
	-+ tls_version, tls_version,
	-+ &sctx, &cctx, cert, privkey)))
	-+ goto end;
	-+
	-+ if (tls_version == TLS1_3_VERSION) {
	-+ if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
	-+ \|\| !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
	-+ \|\| !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
	-+ goto end;
	-+ }
	-+
	-+ if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
	-+ &clientssl, sfd, cfd)))
	-+ goto end;
	-+
	-+ if (cis_ktls) {
	-+ if (!TEST_true(SSL_set_options(clientssl, SSL_OP_ENABLE_KTLS)))
	-+ goto end;
	-+ }
	-+
	-+ if (sis_ktls) {
	-+ if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
	-+ goto end;
	-+ }
	-+
	-+ if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
	-+ goto end;
	-+
	-+ /*
	-+ * The running kernel may not support a given cipher suite
	-+ * or direction, so just check that KTLS isn't used when it
	-+ * isn't enabled.
	-+ */
	-+ if (!cis_ktls) {
	-+ if (!TEST_false(BIO_get_ktls_send(clientssl->wbio)))
	-+ goto end;
	-+ } else {
	-+ if (BIO_get_ktls_send(clientssl->wbio))
	-+ ktls_used = 1;
	-+ }
	-+
	-+ if (!sis_ktls) {
	-+ if (!TEST_false(BIO_get_ktls_send(serverssl->wbio)))
	-+ goto end;
	-+ } else {
	-+ if (BIO_get_ktls_send(serverssl->wbio))
	-+ ktls_used = 1;
	-+ }
	-+
	-+#if defined(OPENSSL_NO_KTLS_RX)
	-+ rx_supported = 0;
	-+#else
	-+ rx_supported = 1;
	-+#endif
	-+ if (!cis_ktls \|\| !rx_supported) {
	-+ if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio)))
	-+ goto end;
	-+ } else {
	-+ if (BIO_get_ktls_send(clientssl->rbio))
	-+ ktls_used = 1;
	-+ }
	-+
	-+ if (!sis_ktls \|\| !rx_supported) {
	-+ if (!TEST_false(BIO_get_ktls_recv(serverssl->rbio)))
	-+ goto end;
	-+ } else {
	-+ if (BIO_get_ktls_send(serverssl->rbio))
	-+ ktls_used = 1;
	-+ }
	-+
	-+ if ((cis_ktls \|\| sis_ktls) && !ktls_used) {
	-+ TEST_info("KTLS not supported for %s cipher %s",
	-+ tls_version == TLS1_3_VERSION ? "TLS 1.3" :
	-+ "TLS 1.2", cipher);
	-+ testresult = 1;
	-+ goto end;
	-+ }
	-+
	-+ if (!TEST_true(ping_pong_query(clientssl, serverssl)))
	-+ goto end;
	-+
	-+ testresult = 1;
	-+end:
	-+ if (clientssl) {
	-+ SSL_shutdown(clientssl);
	-+ SSL_free(clientssl);
	-+ }
	-+ if (serverssl) {
	-+ SSL_shutdown(serverssl);
	-+ SSL_free(serverssl);
	-+ }
	-+ SSL_CTX_free(sctx);
	-+ SSL_CTX_free(cctx);
	-+ serverssl = clientssl = NULL;
	-+ if (cfd != -1)
	-+ close(cfd);
	-+ if (sfd != -1)
	-+ close(sfd);
	-+ return testresult;
	-+}
	-+
	-+#define SENDFILE_SZ (16 * 4096)
	-+#define SENDFILE_CHUNK (4 * 4096)
	-+#define min(a,b) ((a) > (b) ? (b) : (a))
	-+
	-+static int execute_test_ktls_sendfile(int tls_version, const char *cipher)
	-+{
	-+ SSL_CTX cctx = NULL, sctx = NULL;
	-+ SSL clientssl = NULL, serverssl = NULL;
	-+ unsigned char buf, buf_dst;
	-+ BIO out = NULL, in = NULL;
	-+ int cfd = -1, sfd = -1, ffd, err;
	-+ ssize_t chunk_size = 0;
	-+ off_t chunk_off = 0;
	-+ int testresult = 0;
	-+ FILE *ffdp;
	-+
	-+ buf = OPENSSL_zalloc(SENDFILE_SZ);
	-+ buf_dst = OPENSSL_zalloc(SENDFILE_SZ);
	-+ if (!TEST_ptr(buf) \|\| !TEST_ptr(buf_dst)
	-+ \|\| !TEST_true(create_test_sockets(&cfd, &sfd)))
	-+ goto end;
	-+
	-+ /* Skip this test if the platform does not support ktls */
	-+ if (!ktls_chk_platform(sfd)) {
	-+ TEST_info("Kernel does not support KTLS");
	-+ testresult = 1;
	-+ goto end;
	-+ }
	-+
	-+ /* Create a session based on SHA-256 */
	-+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
	-+ TLS_client_method(),
	-+ tls_version, tls_version,
	-+ &sctx, &cctx, cert, privkey)))
	-+ goto end;
	-+
	-+ if (tls_version == TLS1_3_VERSION) {
	-+ if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
	-+ \|\| !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
	-+ goto end;
	-+ } else {
	-+ if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
	-+ \|\| !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
	-+ goto end;
	-+ }
	-+
	-+ if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
	-+ &clientssl, sfd, cfd)))
	-+ goto end;
	-+
	-+ if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
	-+ goto end;
	-+
	-+ if (!TEST_true(create_ssl_connection(serverssl, clientssl,
	-+ SSL_ERROR_NONE)))
	-+ goto end;
	-+
	-+ if (!BIO_get_ktls_send(serverssl->wbio)) {
	-+ TEST_info("Failed to enable KTLS for %s cipher %s",
	-+ tls_version == TLS1_3_VERSION ? "TLS 1.3" :
	-+ "TLS 1.2", cipher);
	-+ testresult = 1;
	-+ goto end;
	-+ }
	-+
	-+ RAND_bytes(buf, SENDFILE_SZ);
	-+
	-+ out = BIO_new_file(tmpfilename, "wb");
	-+ if (!TEST_ptr(out))
	-+ goto end;
	-+
	-+ if (BIO_write(out, buf, SENDFILE_SZ) != SENDFILE_SZ)
	-+ goto end;
	-+
	-+ BIO_free(out);
	-+ out = NULL;
	-+ in = BIO_new_file(tmpfilename, "rb");
	-+ BIO_get_fp(in, &ffdp);
	-+ ffd = fileno(ffdp);
	-+
	-+ while (chunk_off < SENDFILE_SZ) {
	-+ chunk_size = min(SENDFILE_CHUNK, SENDFILE_SZ - chunk_off);
	-+ while ((err = SSL_sendfile(serverssl,
	-+ ffd,
	-+ chunk_off,
	-+ chunk_size,
	-+ 0)) != chunk_size) {
	-+ if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_WRITE)
	-+ goto end;
	-+ }
	-+ while ((err = SSL_read(clientssl,
	-+ buf_dst + chunk_off,
	-+ chunk_size)) != chunk_size) {
	-+ if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ)
	-+ goto end;
	-+ }
	-+
	-+ /* verify the payload */
	-+ if (!TEST_mem_eq(buf_dst + chunk_off,
	-+ chunk_size,
	-+ buf + chunk_off,
	-+ chunk_size))
	-+ goto end;
	-+
	-+ chunk_off += chunk_size;
	-+ }
	-+
	-+ testresult = 1;
	-+end:
	-+ if (clientssl) {
	-+ SSL_shutdown(clientssl);
	-+ SSL_free(clientssl);
	-+ }
	-+ if (serverssl) {
	-+ SSL_shutdown(serverssl);
	-+ SSL_free(serverssl);
	-+ }
	-+ SSL_CTX_free(sctx);
	-+ SSL_CTX_free(cctx);
	-+ serverssl = clientssl = NULL;
	-+ BIO_free(out);
	-+ BIO_free(in);
	-+ if (cfd != -1)
	-+ close(cfd);
	-+ if (sfd != -1)
	-+ close(sfd);
	-+ OPENSSL_free(buf);
	-+ OPENSSL_free(buf_dst);
	-+ return testresult;
	-+}
	-+
	-+static struct ktls_test_cipher {
	-+ int tls_version;
	-+ const char *cipher;
	-+} ktls_test_ciphers[] = {
	-+# if !defined(OPENSSL_NO_TLS1_2)
	-+# ifdef OPENSSL_KTLS_AES_GCM_128
	-+ { TLS1_2_VERSION, "AES128-GCM-SHA256" },
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_CCM_128
	-+ { TLS1_2_VERSION, "AES128-CCM"},
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_GCM_256
	-+ { TLS1_2_VERSION, "AES256-GCM-SHA384"},
	-+# endif
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ { TLS1_2_VERSION, "ECDHE-RSA-CHACHA20-POLY1305"},
	-+# endif
	-+# endif
	-+# if !defined(OPENSSL_NO_TLS1_3)
	-+# ifdef OPENSSL_KTLS_AES_GCM_128
	-+ { TLS1_3_VERSION, "TLS_AES_128_GCM_SHA256" },
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_CCM_128
	-+ { TLS1_3_VERSION, "TLS_AES_128_CCM_SHA256" },
	-+# endif
	-+# ifdef OPENSSL_KTLS_AES_GCM_256
	-+ { TLS1_3_VERSION, "TLS_AES_256_GCM_SHA384" },
	-+# endif
	-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
	-+ { TLS1_3_VERSION, "TLS_CHACHA20_POLY1305_SHA256" },
	-+# endif
	-+# endif
	-+};
	-+
	-+#define NUM_KTLS_TEST_CIPHERS \
	-+ (sizeof(ktls_test_ciphers) / sizeof(ktls_test_ciphers[0]))
	-+
	-+static int test_ktls(int test)
	-+{
	-+ struct ktls_test_cipher *cipher;
	-+ int cis_ktls, sis_ktls;
	-+
	-+ OPENSSL_assert(test / 4 < NUM_KTLS_TEST_CIPHERS);
	-+ cipher = &ktls_test_ciphers[test / 4];
	-+
	-+ cis_ktls = (test & 1) != 0;
	-+ sis_ktls = (test & 2) != 0;
	-+
	-+ return execute_test_ktls(cis_ktls, sis_ktls, cipher->tls_version,
	-+ cipher->cipher);
	-+}
	-+
	-+static int test_ktls_sendfile(int tst)
	-+{
	-+ struct ktls_test_cipher *cipher;
	-+
	-+ OPENSSL_assert(tst < NUM_KTLS_TEST_CIPHERS);
	-+ cipher = &ktls_test_ciphers[tst];
	-+
	-+ return execute_test_ktls_sendfile(cipher->tls_version, cipher->cipher);
	-+}
	-+#endif
	-+
	- static int test_large_message_tls(void)
	- {
	- return execute_test_large_message(TLS_server_method(), TLS_client_method(),
	-@@ -6944,6 +7374,12 @@ int setup_tests(void)
	- return 0;
	- }
	-
	-+#if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
	-+# if !defined(OPENSSL_NO_TLS1_2) \|\| !defined(OPENSSL_NO_TLS1_3)
	-+ ADD_ALL_TESTS(test_ktls, NUM_KTLS_TEST_CIPHERS * 4);
	-+ ADD_ALL_TESTS(test_ktls_sendfile, NUM_KTLS_TEST_CIPHERS);
	-+# endif
	-+#endif
	- ADD_TEST(test_large_message_tls);
	- ADD_TEST(test_large_message_tls_read_ahead);
	- #ifndef OPENSSL_NO_DTLS
	-diff --git test/ssltest_old.c test/ssltest_old.c
	-index 3601066b50..96b38a4636 100644
	---- test/ssltest_old.c
	-+++ test/ssltest_old.c
	-@@ -731,6 +731,8 @@ static void sv_usage(void)
	- fprintf(stderr, " -client_sess_in <file> - Read the client session from a file\n");
	- fprintf(stderr, " -should_reuse <number> - The expected state of reusing the session\n");
	- fprintf(stderr, " -no_ticket - do not issue TLS session ticket\n");
	-+ fprintf(stderr, " -client_ktls - try to enable client KTLS\n");
	-+ fprintf(stderr, " -server_ktls - try to enable server KTLS\n");
	- }
	-
	- static void print_key_details(BIO out, EVP_PKEY key)
	-@@ -905,6 +907,7 @@ int main(int argc, char *argv[])
	- int number = 1, reuse = 0;
	- int should_reuse = -1;
	- int no_ticket = 0;
	-+ int client_ktls = 0, server_ktls = 0;
	- long bytes = 256L;
	- #ifndef OPENSSL_NO_DH
	- DH *dh;
	-@@ -1215,6 +1218,10 @@ int main(int argc, char *argv[])
	- should_reuse = !!atoi(*(++argv));
	- } else if (strcmp(*argv, "-no_ticket") == 0) {
	- no_ticket = 1;
	-+ } else if (strcmp(*argv, "-client_ktls") == 0) {
	-+ client_ktls = 1;
	-+ } else if (strcmp(*argv, "-server_ktls") == 0) {
	-+ server_ktls = 1;
	- } else {
	- int rv;
	- arg = argv[0];
	-@@ -1760,6 +1767,10 @@ int main(int argc, char *argv[])
	-
	- if (sn_client)
	- SSL_set_tlsext_host_name(c_ssl, sn_client);
	-+ if (client_ktls)
	-+ SSL_set_options(c_ssl, SSL_OP_ENABLE_KTLS);
	-+ if (server_ktls)
	-+ SSL_set_options(s_ssl, SSL_OP_ENABLE_KTLS);
	-
	- if (!set_protocol_version(server_min_proto, s_ssl, SSL_CTRL_SET_MIN_PROTO_VERSION))
	- goto end;
	-diff --git test/ssltestlib.c test/ssltestlib.c
	-index 456afdf471..a13fdbc4cc 100644
	---- test/ssltestlib.c
	-+++ test/ssltestlib.c
	-@@ -16,6 +16,14 @@
	-
	- #ifdef OPENSSL_SYS_UNIX
	- # include <unistd.h>
	-+#ifndef OPENSSL_NO_KTLS
	-+# include <netinet/in.h>
	-+# include <netinet/in.h>
	-+# include <arpa/inet.h>
	-+# include <sys/socket.h>
	-+# include <unistd.h>
	-+# include <fcntl.h>
	-+#endif
	-
	- static ossl_inline void ossl_sleep(unsigned int millis)
	- {
	-@@ -763,6 +771,113 @@ int create_ssl_ctx_pair(const SSL_METHOD sm, const SSL_METHOD cm,
	-
	- #define MAXLOOPS 1000000
	-
	-+#if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
	-+static int set_nb(int fd)
	-+{
	-+ int flags;
	-+
	-+ flags = fcntl(fd,F_GETFL,0);
	-+ if (flags == -1)
	-+ return flags;
	-+ flags = fcntl(fd, F_SETFL, flags \| O_NONBLOCK);
	-+ return flags;
	-+}
	-+
	-+int create_test_sockets(int cfdp, int sfdp)
	-+{
	-+ struct sockaddr_in sin;
	-+ const char *host = "127.0.0.1";
	-+ int cfd_connected = 0, ret = 0;
	-+ socklen_t slen = sizeof(sin);
	-+ int afd = -1, cfd = -1, sfd = -1;
	-+
	-+ memset ((char *) &sin, 0, sizeof(sin));
	-+ sin.sin_family = AF_INET;
	-+ sin.sin_addr.s_addr = inet_addr(host);
	-+
	-+ afd = socket(AF_INET, SOCK_STREAM, 0);
	-+ if (afd < 0)
	-+ return 0;
	-+
	-+ if (bind(afd, (struct sockaddr*)&sin, sizeof(sin)) < 0)
	-+ goto out;
	-+
	-+ if (getsockname(afd, (struct sockaddr*)&sin, &slen) < 0)
	-+ goto out;
	-+
	-+ if (listen(afd, 1) < 0)
	-+ goto out;
	-+
	-+ cfd = socket(AF_INET, SOCK_STREAM, 0);
	-+ if (cfd < 0)
	-+ goto out;
	-+
	-+ if (set_nb(afd) == -1)
	-+ goto out;
	-+
	-+ while (sfd == -1 \|\| !cfd_connected ) {
	-+ sfd = accept(afd, NULL, 0);
	-+ if (sfd == -1 && errno != EAGAIN)
	-+ goto out;
	-+
	-+ if (!cfd_connected && connect(cfd, (struct sockaddr*)&sin, sizeof(sin)) < 0)
	-+ goto out;
	-+ else
	-+ cfd_connected = 1;
	-+ }
	-+
	-+ if (set_nb(cfd) == -1 \|\| set_nb(sfd) == -1)
	-+ goto out;
	-+ ret = 1;
	-+ *cfdp = cfd;
	-+ *sfdp = sfd;
	-+ goto success;
	-+
	-+out:
	-+ if (cfd != -1)
	-+ close(cfd);
	-+ if (sfd != -1)
	-+ close(sfd);
	-+success:
	-+ if (afd != -1)
	-+ close(afd);
	-+ return ret;
	-+}
	-+
	-+int create_ssl_objects2(SSL_CTX serverctx, SSL_CTX clientctx, SSL **sssl,
	-+ SSL **cssl, int sfd, int cfd)
	-+{
	-+ SSL serverssl = NULL, clientssl = NULL;
	-+ BIO s_to_c_bio = NULL, c_to_s_bio = NULL;
	-+
	-+ if (*sssl != NULL)
	-+ serverssl = *sssl;
	-+ else if (!TEST_ptr(serverssl = SSL_new(serverctx)))
	-+ goto error;
	-+ if (*cssl != NULL)
	-+ clientssl = *cssl;
	-+ else if (!TEST_ptr(clientssl = SSL_new(clientctx)))
	-+ goto error;
	-+
	-+ if (!TEST_ptr(s_to_c_bio = BIO_new_socket(sfd, BIO_NOCLOSE))
	-+ \|\| !TEST_ptr(c_to_s_bio = BIO_new_socket(cfd, BIO_NOCLOSE)))
	-+ goto error;
	-+
	-+ SSL_set_bio(clientssl, c_to_s_bio, c_to_s_bio);
	-+ SSL_set_bio(serverssl, s_to_c_bio, s_to_c_bio);
	-+ *sssl = serverssl;
	-+ *cssl = clientssl;
	-+ return 1;
	-+
	-+ error:
	-+ SSL_free(serverssl);
	-+ SSL_free(clientssl);
	-+ BIO_free(s_to_c_bio);
	-+ BIO_free(c_to_s_bio);
	-+ return 0;
	-+}
	-+#endif
	-+
	- /*
	- * NOTE: Transfers control of the BIOs - this function will free them on error
	- */
	-diff --git test/ssltestlib.h test/ssltestlib.h
	-index 17b278219a..756975435d 100644
	---- test/ssltestlib.h
	-+++ test/ssltestlib.h
	-@@ -20,6 +20,9 @@ int create_ssl_objects(SSL_CTX serverctx, SSL_CTX clientctx, SSL **sssl,
	- SSL *cssl, BIO s_to_c_fbio, BIO *c_to_s_fbio);
	- int create_bare_ssl_connection(SSL serverssl, SSL clientssl, int want,
	- int read);
	-+int create_ssl_objects2(SSL_CTX serverctx, SSL_CTX clientctx, SSL **sssl,
	-+ SSL **cssl, int sfd, int cfd);
	-+int create_test_sockets(int cfd, int sfd);
	- int create_ssl_connection(SSL serverssl, SSL clientssl, int want);
	- void shutdown_ssl_connection(SSL serverssl, SSL clientssl);
	-
	-diff --git util/libssl.num util/libssl.num
	-index 297522c363..5b3c048871 100644
	---- util/libssl.num
	-+++ util/libssl.num
	-@@ -498,3 +498,4 @@ SSL_CTX_get_recv_max_early_data 498 1_1_1 EXIST::FUNCTION:
	- SSL_CTX_set_recv_max_early_data 499 1_1_1 EXIST::FUNCTION:
	- SSL_CTX_set_post_handshake_auth 500 1_1_1 EXIST::FUNCTION:
	- SSL_get_signature_type_nid 501 1_1_1a EXIST::FUNCTION:
	-+SSL_sendfile 502 1_1_1e EXIST::FUNCTION:
	-diff --git util/private.num util/private.num
	-index bc7d967b5d..5bfbfc9fa4 100644
	---- util/private.num
	-+++ util/private.num
	-@@ -109,6 +109,8 @@ BIO_get_buffer_num_lines define
	- BIO_get_cipher_ctx define
	- BIO_get_cipher_status define
	- BIO_get_close define
	-+BIO_get_ktls_send define
	-+BIO_get_ktls_recv define
	- BIO_get_conn_address define
	- BIO_get_conn_hostname define
	- BIO_get_conn_port define
	diff --git a/security/openssl111/files/extra-patch-util_process__docs.pl b/security/openssl111/files/extra-patch-util_process__docs.pl
	deleted file mode 100644
	--- a/security/openssl111/files/extra-patch-util_process__docs.pl
	+++ /dev/null
	@@ -1,20 +0,0 @@
	---- util/process_docs.pl.orig 2018-09-11 12:48:25 UTC
	-+++ util/process_docs.pl
	-@@ -43,7 +43,7 @@ GetOptions(\%options,
	- );
	-
	- unless ($options{section}) {
	-- $options{section} = [ 1, 3, 5, 7 ];
	-+ $options{section} = [ 1, 5 ];
	- }
	- unless ($options{sourcedir}) {
	- $options{sourcedir} = catdir($config{sourcedir}, "doc");
	-@@ -98,7 +98,7 @@ foreach my $section (sort @{$options{sec
	- my $suffix = { man => ".$podinfo{section}".($options{suffix} // ""),
	- html => ".html" } -> {$options{type}};
	- my $generate = { man => "pod2man --name=$name --section=$podinfo{section} --center=OpenSSL --release=$config{version} \"$podpath\"",
	-- html => "pod2html \"--podroot=$options{sourcedir}\" --htmldir=$updir --podpath=man1:man3:man5:man7 \"--infile=$podpath\" \"--title=$podname\" --quiet"
	-+ html => "pod2html \"--podroot=$options{sourcedir}\" --htmldir=$updir --podpath=man1:man5 \"--infile=$podpath\" \"--title=$podname\" --quiet"
	- } -> {$options{type}};
	- my $output_dir = catdir($options{destdir}, "man$podinfo{section}");
	- my $output_file = $podname . $suffix;
	diff --git a/security/openssl111/files/patch-crypto_async_arch_async__posix.h b/security/openssl111/files/patch-crypto_async_arch_async__posix.h
	deleted file mode 100644
	--- a/security/openssl111/files/patch-crypto_async_arch_async__posix.h
	+++ /dev/null
	@@ -1,32 +0,0 @@
	-commit e883812f463c1623249e038698ccaddf2baa34d8
	-Author: Warner Losh <imp@FreeBSD.org>
	-Date: Mon Mar 18 19:48:22 2024 -0600
	-
	- posix_async: FreeBSD also defines {make\|swap\|get\|set}context
	-
	- FreeBSD also defines {make\|swap\|get\|set}context for backward
	- compatibility, despite also exposing POSIX_VERSION 200809L
	- in FreeBSD 15-current.
	-
	- Note: There's no fallback for POSIX_VERSION 200809 without these
	- routines, so maybe that should be a #error? ... But that's a questionf
	- or upstream.
	-
	- FreeBSD has defined these interfaces since FreeBSD 4.7, released over 20
	- years ago, so no further nuance in FreeBSD version number is necessary.
	-
	- Pull Request: https://github.com/openssl/openssl/pull/23885
	-
	-diff --git a/crypto/async/arch/async_posix.h b/crypto/async/arch/async_posix.h
	-index a17c6b8e68af..2d97ec3acc9b 100644
	---- crypto/async/arch/async_posix.h
	-+++ crypto/async/arch/async_posix.h
	-@@ -18,7 +18,7 @@
	- # include <unistd.h>
	-
	- # if _POSIX_VERSION >= 200112L \
	-- && (_POSIX_VERSION < 200809L \|\| defined(__GLIBC__))
	-+ && (_POSIX_VERSION < 200809L \|\| defined(__GLIBC__) \|\| defined(__FreeBSD__))
	-
	- # include <pthread.h>
	-
	diff --git a/security/openssl111/files/pkg-message.in b/security/openssl111/files/pkg-message.in
	deleted file mode 100644
	--- a/security/openssl111/files/pkg-message.in
	+++ /dev/null
	@@ -1,8 +0,0 @@
	-[
	-{ type: install
	- message: <<EOM
	-Copy %%PREFIX%%/openssl/openssl.cnf.sample to %%PREFIX%%/openssl/openssl.cnf
	-and edit it to fit your needs.
	-EOM
	-}
	-]
	diff --git a/security/openssl111/pkg-descr b/security/openssl111/pkg-descr
	deleted file mode 100644
	--- a/security/openssl111/pkg-descr
	+++ /dev/null
	@@ -1,13 +0,0 @@
	-The OpenSSL Project is a collaborative effort to develop a robust,
	-commercial-grade, full-featured, and Open Source toolkit implementing
	-the Secure Sockets Layer (SSL v3) and Transport Layer Security (TLS v1,
	-v1.1, v1.2, v1.3) protocols with full-strength cryptography world-wide.
	-The project is managed by a worldwide community of volunteers that use
	-the Internet to communicate, plan, and develop the OpenSSL tookit
	-and its related documentation.
	-
	-OpenSSL is based on the excellent SSLeay library developed by Eric
	-A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under
	-an Apache-style licence, which basically means that you are free
	-to get and use it for commercial and non-commercial purposes subject
	-to some simple license conditions.
	diff --git a/security/openssl111/pkg-plist b/security/openssl111/pkg-plist
	deleted file mode 100644
	--- a/security/openssl111/pkg-plist
	+++ /dev/null
	@@ -1,226 +0,0 @@
	-bin/c_rehash
	-bin/openssl
	-include/openssl/aes.h
	-include/openssl/asn1.h
	-include/openssl/asn1_mac.h
	-include/openssl/asn1err.h
	-include/openssl/asn1t.h
	-include/openssl/async.h
	-include/openssl/asyncerr.h
	-include/openssl/bio.h
	-include/openssl/bioerr.h
	-include/openssl/blowfish.h
	-include/openssl/bn.h
	-include/openssl/bnerr.h
	-include/openssl/buffer.h
	-include/openssl/buffererr.h
	-include/openssl/camellia.h
	-include/openssl/cast.h
	-include/openssl/cmac.h
	-include/openssl/cms.h
	-include/openssl/cmserr.h
	-include/openssl/comp.h
	-include/openssl/comperr.h
	-include/openssl/conf.h
	-include/openssl/conf_api.h
	-include/openssl/conferr.h
	-include/openssl/crypto.h
	-include/openssl/cryptoerr.h
	-include/openssl/ct.h
	-include/openssl/cterr.h
	-include/openssl/des.h
	-include/openssl/dh.h
	-include/openssl/dherr.h
	-include/openssl/dsa.h
	-include/openssl/dsaerr.h
	-include/openssl/dtls1.h
	-include/openssl/e_os2.h
	-include/openssl/ebcdic.h
	-include/openssl/ec.h
	-include/openssl/ecdh.h
	-include/openssl/ecdsa.h
	-include/openssl/ecerr.h
	-include/openssl/engine.h
	-include/openssl/engineerr.h
	-include/openssl/err.h
	-include/openssl/evp.h
	-include/openssl/evperr.h
	-include/openssl/hmac.h
	-include/openssl/idea.h
	-include/openssl/kdf.h
	-include/openssl/kdferr.h
	-include/openssl/lhash.h
	-include/openssl/md2.h
	-include/openssl/md4.h
	-include/openssl/md5.h
	-include/openssl/mdc2.h
	-include/openssl/modes.h
	-include/openssl/obj_mac.h
	-include/openssl/objects.h
	-include/openssl/objectserr.h
	-include/openssl/ocsp.h
	-include/openssl/ocsperr.h
	-include/openssl/opensslconf.h
	-include/openssl/opensslv.h
	-include/openssl/ossl_typ.h
	-include/openssl/pem.h
	-include/openssl/pem2.h
	-include/openssl/pemerr.h
	-include/openssl/pkcs12.h
	-include/openssl/pkcs12err.h
	-include/openssl/pkcs7.h
	-include/openssl/pkcs7err.h
	-include/openssl/rand.h
	-include/openssl/rand_drbg.h
	-include/openssl/randerr.h
	-include/openssl/rc2.h
	-include/openssl/rc4.h
	-include/openssl/rc5.h
	-include/openssl/ripemd.h
	-include/openssl/rsa.h
	-include/openssl/rsaerr.h
	-include/openssl/safestack.h
	-include/openssl/seed.h
	-include/openssl/sha.h
	-include/openssl/srp.h
	-include/openssl/srtp.h
	-include/openssl/ssl.h
	-include/openssl/ssl2.h
	-include/openssl/ssl3.h
	-include/openssl/sslerr.h
	-include/openssl/stack.h
	-include/openssl/store.h
	-include/openssl/storeerr.h
	-include/openssl/symhacks.h
	-include/openssl/tls1.h
	-include/openssl/ts.h
	-include/openssl/tserr.h
	-include/openssl/txt_db.h
	-include/openssl/ui.h
	-include/openssl/uierr.h
	-include/openssl/whrlpool.h
	-include/openssl/x509.h
	-include/openssl/x509_vfy.h
	-include/openssl/x509err.h
	-include/openssl/x509v3.h
	-include/openssl/x509v3err.h
	-%%SHARED%%lib/engines-1.1/capi.so
	-%%SHARED%%lib/engines-1.1/padlock.so
	-lib/libcrypto.a
	-%%SHARED%%lib/libcrypto.so
	-%%SHARED%%lib/libcrypto.so.%%SHLIBVER%%
	-lib/libssl.a
	-%%SHARED%%lib/libssl.so
	-%%SHARED%%lib/libssl.so.%%SHLIBVER%%
	-libdata/pkgconfig/libcrypto.pc
	-libdata/pkgconfig/libssl.pc
	-libdata/pkgconfig/openssl.pc
	-share/man/man1/CA.pl.1.gz
	-share/man/man1/asn1parse.1.gz
	-share/man/man1/c_rehash.1.gz
	-share/man/man1/ca.1.gz
	-share/man/man1/ciphers.1.gz
	-share/man/man1/cms.1.gz
	-share/man/man1/crl.1.gz
	-share/man/man1/crl2pkcs7.1.gz
	-share/man/man1/dgst.1.gz
	-share/man/man1/dhparam.1.gz
	-share/man/man1/dsa.1.gz
	-share/man/man1/dsaparam.1.gz
	-share/man/man1/ec.1.gz
	-share/man/man1/ecparam.1.gz
	-share/man/man1/enc.1.gz
	-share/man/man1/engine.1.gz
	-share/man/man1/errstr.1.gz
	-share/man/man1/gendsa.1.gz
	-share/man/man1/genpkey.1.gz
	-share/man/man1/genrsa.1.gz
	-share/man/man1/list.1.gz
	-share/man/man1/nseq.1.gz
	-share/man/man1/ocsp.1.gz
	-share/man/man1/openssl-asn1parse.1.gz
	-share/man/man1/openssl-c_rehash.1.gz
	-share/man/man1/openssl-ca.1.gz
	-share/man/man1/openssl-ciphers.1.gz
	-share/man/man1/openssl-cms.1.gz
	-share/man/man1/openssl-crl.1.gz
	-share/man/man1/openssl-crl2pkcs7.1.gz
	-share/man/man1/openssl-dgst.1.gz
	-share/man/man1/openssl-dhparam.1.gz
	-share/man/man1/openssl-dsa.1.gz
	-share/man/man1/openssl-dsaparam.1.gz
	-share/man/man1/openssl-ec.1.gz
	-share/man/man1/openssl-ecparam.1.gz
	-share/man/man1/openssl-enc.1.gz
	-share/man/man1/openssl-engine.1.gz
	-share/man/man1/openssl-errstr.1.gz
	-share/man/man1/openssl-gendsa.1.gz
	-share/man/man1/openssl-genpkey.1.gz
	-share/man/man1/openssl-genrsa.1.gz
	-share/man/man1/openssl-list.1.gz
	-share/man/man1/openssl-nseq.1.gz
	-share/man/man1/openssl-ocsp.1.gz
	-share/man/man1/openssl-passwd.1.gz
	-share/man/man1/openssl-pkcs12.1.gz
	-share/man/man1/openssl-pkcs7.1.gz
	-share/man/man1/openssl-pkcs8.1.gz
	-share/man/man1/openssl-pkey.1.gz
	-share/man/man1/openssl-pkeyparam.1.gz
	-share/man/man1/openssl-pkeyutl.1.gz
	-share/man/man1/openssl-prime.1.gz
	-share/man/man1/openssl-rand.1.gz
	-share/man/man1/openssl-rehash.1.gz
	-share/man/man1/openssl-req.1.gz
	-share/man/man1/openssl-rsa.1.gz
	-share/man/man1/openssl-rsautl.1.gz
	-share/man/man1/openssl-s_client.1.gz
	-share/man/man1/openssl-s_server.1.gz
	-share/man/man1/openssl-s_time.1.gz
	-share/man/man1/openssl-sess_id.1.gz
	-share/man/man1/openssl-smime.1.gz
	-share/man/man1/openssl-speed.1.gz
	-share/man/man1/openssl-spkac.1.gz
	-share/man/man1/openssl-srp.1.gz
	-share/man/man1/openssl-storeutl.1.gz
	-share/man/man1/openssl-ts.1.gz
	-share/man/man1/openssl-tsget.1.gz
	-share/man/man1/openssl-verify.1.gz
	-share/man/man1/openssl-version.1.gz
	-share/man/man1/openssl-x509.1.gz
	-share/man/man1/openssl.1.gz
	-share/man/man1/passwd.1.gz
	-share/man/man1/pkcs12.1.gz
	-share/man/man1/pkcs7.1.gz
	-share/man/man1/pkcs8.1.gz
	-share/man/man1/pkey.1.gz
	-share/man/man1/pkeyparam.1.gz
	-share/man/man1/pkeyutl.1.gz
	-share/man/man1/prime.1.gz
	-share/man/man1/rand.1.gz
	-share/man/man1/rehash.1.gz
	-share/man/man1/req.1.gz
	-share/man/man1/rsa.1.gz
	-share/man/man1/rsautl.1.gz
	-share/man/man1/s_client.1.gz
	-share/man/man1/s_server.1.gz
	-share/man/man1/s_time.1.gz
	-share/man/man1/sess_id.1.gz
	-share/man/man1/smime.1.gz
	-share/man/man1/speed.1.gz
	-share/man/man1/spkac.1.gz
	-share/man/man1/srp.1.gz
	-share/man/man1/storeutl.1.gz
	-share/man/man1/ts.1.gz
	-share/man/man1/tsget.1.gz
	-share/man/man1/verify.1.gz
	-share/man/man1/version.1.gz
	-share/man/man1/x509.1.gz
	-share/man/man5/config.5.gz
	-share/man/man5/x509v3_config.5.gz
	-%%OPENSSLDIR%%/misc/CA.pl
	-%%OPENSSLDIR%%/misc/tsget
	-@comment %%OPENSSLDIR%%/misc/tsget.pl
	-@sample %%OPENSSLDIR%%/openssl.cnf.dist %%OPENSSLDIR%%/openssl.cnf
	-@sample %%OPENSSLDIR%%/ct_log_list.cnf.dist %%OPENSSLDIR%%/ct_log_list.cnf
	-@dir %%OPENSSLDIR%%/private
	-@dir %%OPENSSLDIR%%/certs
	diff --git a/security/openssl111/version.mk b/security/openssl111/version.mk
	deleted file mode 100644
	--- a/security/openssl111/version.mk
	+++ /dev/null
	@@ -1 +0,0 @@
	-OPENSSL_SHLIBVER?= 11
	diff --git a/security/openssl34/Makefile b/security/openssl34/Makefile
	--- a/security/openssl34/Makefile
	+++ b/security/openssl34/Makefile
	@@ -51,8 +51,6 @@

	.if ${MACHINE_ARCH} == "amd64"
	OPTIONS_GROUP_OPTIMIZE+= EC
	-.elif ${MACHINE_ARCH} == "mips64el"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	.endif

	OPTIONS_SUB= yes
	diff --git a/security/openssl35/Makefile b/security/openssl35/Makefile
	--- a/security/openssl35/Makefile
	+++ b/security/openssl35/Makefile
	@@ -51,8 +51,6 @@

	.if ${MACHINE_ARCH} == "amd64"
	OPTIONS_GROUP_OPTIMIZE+= EC
	-.elif ${MACHINE_ARCH} == "mips64el"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	.endif

	OPTIONS_SUB= yes
	diff --git a/security/openssl36/Makefile b/security/openssl36/Makefile
	--- a/security/openssl36/Makefile
	+++ b/security/openssl36/Makefile
	@@ -51,8 +51,6 @@

	.if ${MACHINE_ARCH} == "amd64"
	OPTIONS_GROUP_OPTIMIZE+= EC
	-.elif ${MACHINE_ARCH} == "mips64el"
	-OPTIONS_GROUP_OPTIMIZE+= EC
	.endif

	OPTIONS_SUB= yes
	diff --git a/security/openvpn-devel/Makefile b/security/openvpn-devel/Makefile
	--- a/security/openvpn-devel/Makefile
	+++ b/security/openvpn-devel/Makefile
	@@ -57,7 +57,6 @@
	OPTIONS_DEFAULT= DCO EASYRSA LZ4 OPENSSL TEST
	OPTIONS_SINGLE= SSL
	OPTIONS_SINGLE_SSL= MBEDTLS OPENSSL
	-OPTIONS_EXCLUDE_FreeBSD_13= DCO # FreeBSD 14 only

	# option descriptions and interdependencies

	diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile
	--- a/security/openvpn/Makefile
	+++ b/security/openvpn/Makefile
	@@ -45,7 +45,6 @@
	OPTIONS_DEFINE= ASYNC_PUSH DCO DOCS EASYRSA EXAMPLES LZ4 LZO PKCS11 SMALL \
	TEST UNITTESTS X509ALTUSERNAME
	OPTIONS_DEFAULT= DCO EASYRSA LZ4 LZO PKCS11 TEST
	-OPTIONS_EXCLUDE_FreeBSD_13= DCO # FreeBSD 14 only

	ASYNC_PUSH_DESC= Enable async-push support
	DCO_DESC= Data Channel Offload/ovpn(4) support->README.dco.md
	diff --git a/security/opie/Makefile b/security/opie/Makefile
	--- a/security/opie/Makefile
	+++ b/security/opie/Makefile
	@@ -23,6 +23,4 @@
	LIBDIR=${PREFIX}/lib \
	MANDIR=${PREFIX}/share/man/man

	-IGNORE_FreeBSD_13= FreeBSD 13 has OPIE in base
	-
	.include <bsd.port.mk>
	diff --git a/security/osv-scanner/Makefile b/security/osv-scanner/Makefile
	--- a/security/osv-scanner/Makefile
	+++ b/security/osv-scanner/Makefile
	@@ -13,7 +13,7 @@

	USES= go:1.25+,modules,run

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe

	_BUILD_VERSION= ${DISTVERSION}
	_BUILD_COMMIT= b97d1de
	diff --git a/security/p11-kit/Makefile b/security/p11-kit/Makefile
	--- a/security/p11-kit/Makefile
	+++ b/security/p11-kit/Makefile
	@@ -49,10 +49,6 @@
	${RMDIR} ${STAGEDIR}${PREFIX}/etc/pkcs11
	${MKDIR} ${STAGEDIR}${DATADIR}/certs
	${LN} -s /usr/share/certs/trusted ${STAGEDIR}${DATADIR}/certs/anchors
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400024
	- ${LN} -s /usr/share/certs/blacklisted ${STAGEDIR}${DATADIR}/certs/blocklist
	-.else
	${LN} -s /usr/share/certs/untrusted ${STAGEDIR}${DATADIR}/certs/blocklist
	-.endif

	.include <bsd.port.mk>
	diff --git a/security/p5-Crypt-Curve25519/Makefile b/security/p5-Crypt-Curve25519/Makefile
	--- a/security/p5-Crypt-Curve25519/Makefile
	+++ b/security/p5-Crypt-Curve25519/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= ART10 GPLv1+
	LICENSE_COMB= dual

	-BROKEN_mips= fails to build: -m32 flag is not supported by this configuration
	-BROKEN_mips64= fails to build: -m32 flag is not supported by this configuration
	-
	USES= perl5 ssl
	USE_PERL5= configure

	diff --git a/security/p5-Crypt-RHash/Makefile b/security/p5-Crypt-RHash/Makefile
	--- a/security/p5-Crypt-RHash/Makefile
	+++ b/security/p5-Crypt-RHash/Makefile
	@@ -11,8 +11,6 @@
	LICENSE= BSD0CLAUSE
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips64= Fails to build: error Cannot detect CPU architechture
	-
	USES= perl5
	USE_PERL5= configure

	diff --git a/security/p5-Digest-GOST/Makefile b/security/p5-Digest-GOST/Makefile
	--- a/security/p5-Digest-GOST/Makefile
	+++ b/security/p5-Digest-GOST/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= ART10 GPLv1+
	LICENSE_COMB= dual

	-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips64 riscv64
	+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
	NOT_FOR_ARCHS_REASON= fails to build: Cannot detect CPU architechture

	USES= perl5
	diff --git a/security/pam_ssh_agent_auth/Makefile b/security/pam_ssh_agent_auth/Makefile
	--- a/security/pam_ssh_agent_auth/Makefile
	+++ b/security/pam_ssh_agent_auth/Makefile
	@@ -15,8 +15,6 @@
	GH_TAGNAME= 099beb2
	GH_TUPLE= floodyberry:ed25519-donna:8757bd4:floodyberry_ed25519_donna/ed25519-donna

	-BROKEN_mips64= fails to compile: ed25519-donna-portable.h:85:4: Need a uint128_t implementation!
	-
	USES= perl5 ssl tar:bzip2
	USE_PERL5= build

	diff --git a/security/pgpin/Makefile b/security/pgpin/Makefile
	--- a/security/pgpin/Makefile
	+++ b/security/pgpin/Makefile
	@@ -12,7 +12,6 @@

	LICENSE= MIT

	-BROKEN_mips64= Does not build
	BROKEN_riscv64= Does not build: make: don't know how to make freebsd-riscv64

	PORTSCOUT= ignore:1
	diff --git a/security/picocrypt/Makefile b/security/picocrypt/Makefile
	--- a/security/picocrypt/Makefile
	+++ b/security/picocrypt/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/../LICENSE

	-ONLY_FOR_ARCHS= aarch64 amd64 mips64 powerpc64 powerpc64le riscv64
	+ONLY_FOR_ARCHS= aarch64 amd64 powerpc64 powerpc64le riscv64
	ONLY_FOR_ARCHS_REASON= upstream only supports 64-bit
	# https://github.com/HACKERALERT/Picocrypt/issues/127

	diff --git a/security/rcracki_mt/Makefile b/security/rcracki_mt/Makefile
	--- a/security/rcracki_mt/Makefile
	+++ b/security/rcracki_mt/Makefile
	@@ -10,7 +10,7 @@

	LICENSE= GPLv2

	-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips mips64 riscv64
	+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
	NOT_FOR_ARCHS_REASON= cannot detect endianness

	WRKSRC= ${WRKDIR}/${DISTNAME}/${PORTNAME}
	diff --git a/security/samhain/Makefile b/security/samhain/Makefile
	--- a/security/samhain/Makefile
	+++ b/security/samhain/Makefile
	@@ -11,9 +11,6 @@

	LICENSE= GPLv2

	-BROKEN_mips= fails to configure: error: Could not find the libwrap library
	-BROKEN_mips64= fails to configure: error: Could not find the libwrap library
	-
	USES= shebangfix
	SHEBANG_FILES= scripts/samhainadmin-gpg.pl.in \
	scripts/samhainadmin-sig.pl.in
	diff --git a/security/softether5/Makefile b/security/softether5/Makefile
	--- a/security/softether5/Makefile
	+++ b/security/softether5/Makefile
	@@ -64,8 +64,7 @@
	.include <bsd.port.pre.mk>

	# devel/cpu_features not available on these archs, see devel/cpu_features/Makefile
	-.if (${ARCH} == aarch64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| \
	- ${ARCH} == mips \|\| ${ARCH} == mips64)
	+.if (${ARCH} == aarch64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7)
	# skip cpu_features when devel/cpu_features is not available
	CMAKE_ARGS+= -DSKIP_CPU_FEATURES=1
	.else
	diff --git a/security/sudo/Makefile b/security/sudo/Makefile
	--- a/security/sudo/Makefile
	+++ b/security/sudo/Makefile
	@@ -115,7 +115,7 @@

	.include <bsd.port.options.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400072
	+.if ${OPSYS} == FreeBSD
	. if ${PORT_OPTIONS:MOPIE}
	BUILD_DEPENDS+= opie>0:security/opie
	RUN_DEPENDS+= opie>0:security/opie
	diff --git a/security/tclsasl/Makefile b/security/tclsasl/Makefile
	--- a/security/tclsasl/Makefile
	+++ b/security/tclsasl/Makefile
	@@ -23,7 +23,7 @@

	.include <bsd.port.options.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400091
	+.if ${OPSYS} == FreeBSD
	CPPFLAGS+= -Wno-error=incompatible-function-pointer-types
	.endif

	diff --git a/security/tpm2-openssl/Makefile b/security/tpm2-openssl/Makefile
	--- a/security/tpm2-openssl/Makefile
	+++ b/security/tpm2-openssl/Makefile
	@@ -10,8 +10,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-IGNORE_FreeBSD_13= Requires OpenSSL 3+
	-
	LIB_DEPENDS= libtss2-esys.so:security/tpm2-tss
	RUN_DEPENDS= tpm2-abrmd:security/tpm2-abrmd

	diff --git a/security/vaultwarden/Makefile b/security/vaultwarden/Makefile
	--- a/security/vaultwarden/Makefile
	+++ b/security/vaultwarden/Makefile
	@@ -12,7 +12,6 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE.txt

	BROKEN_i386= doesn't buld on pkg builder
	-BROKEN_FreeBSD_13= fails to compile : Needs OpenSSL v3.0.0 or later to compile

	LIB_DEPENDS+= libcapnp.so:devel/capnproto \
	libgmp.so:math/gmp \
	diff --git a/security/wazuh-agent/Makefile b/security/wazuh-agent/Makefile
	--- a/security/wazuh-agent/Makefile
	+++ b/security/wazuh-agent/Makefile
	@@ -102,9 +102,7 @@

	.include <bsd.port.pre.mk>

	-.if ${OSVERSION} >= 1300139 && ${OSVERSION} < 1400000
	-FBSD_MAJOR_VERSION=13
	-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	FBSD_MAJOR_VERSION=14
	.elif ${OSVERSION} >= 1500000 && ${OSVERSION} < 1600000
	FBSD_MAJOR_VERSION=15
	diff --git a/security/wazuh-manager/Makefile b/security/wazuh-manager/Makefile
	--- a/security/wazuh-manager/Makefile
	+++ b/security/wazuh-manager/Makefile
	@@ -166,25 +166,15 @@

	.include <bsd.port.pre.mk>

	-.if ${ARCH} == "aarch64" && ${OSVERSION} < 1400000
	-IGNORE= FreeBSD ${OSVERSION} ${ARCH} is not supported
	-.endif
	-
	.if ${ARCH} == "aarch64"
	FBSD14_PATCH_LEVEL= _p5
	.endif

	.if ${ARCH} != "aarch64"
	-FBSD13_PATCH_LEVEL= _p6
	FBSD14_PATCH_LEVEL= _p5
	.endif

	-.if ${OSVERSION} >= 1300139 && ${OSVERSION} < 1400000
	-FBSD_VERSION_BASE=freebsd_13_5_release${FBSD13_PATCH_LEVEL}
	-FBSD_MAJOR_VERSION=13
	-WAZUH_CACHENAME=${PORTNAME}-cache-fbsd13-${ARCH}-${DISTVERSION}
	-DISTFILES+= ${WAZUH_CACHENAME}${EXTRACT_SUFX}:wazuh_cache
	-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	FBSD_VERSION_BASE=freebsd_14_3_release${FBSD14_PATCH_LEVEL}
	FBSD_MAJOR_VERSION=14
	WAZUH_CACHENAME=${PORTNAME}-cache-fbsd14-${ARCH}-${DISTVERSION}
	diff --git a/security/wazuh-manager/distinfo b/security/wazuh-manager/distinfo
	--- a/security/wazuh-manager/distinfo
	+++ b/security/wazuh-manager/distinfo
	@@ -59,8 +59,6 @@
	SIZE (wazuh-4.14.3/wazuh-cache-any-4.14.3.tar.gz) = 21559211
	SHA256 (wazuh-4.14.3/wazuh-python-4.14.3.tar.gz) = ea6b909468facda5346796c9c8fe1af500379a6a41c01f5ba335923f910115e7
	SIZE (wazuh-4.14.3/wazuh-python-4.14.3.tar.gz) = 481926
	-SHA256 (wazuh-4.14.3/wazuh-cache-fbsd13-amd64-4.14.3.tar.gz) = e894bdc1697a8c4976e1cc68961c602850ec24582d5cc17baed82d8086620005
	-SIZE (wazuh-4.14.3/wazuh-cache-fbsd13-amd64-4.14.3.tar.gz) = 26641362
	SHA256 (wazuh-4.14.3/wazuh-cache-fbsd14-aarch64-4.14.3.tar.gz) = 7984654011ed67fffcc2f1f4297df5a4708d8d1dd6a79ab5c1dd295250883feb
	SIZE (wazuh-4.14.3/wazuh-cache-fbsd14-aarch64-4.14.3.tar.gz) = 24707892
	SHA256 (wazuh-4.14.3/wazuh-cache-fbsd14-amd64-4.14.3.tar.gz) = f2b26a36b116348e3443e7133017713956e8ed2e26eed90e4f396eb55a241eda
	diff --git a/sysutils/arc_summary/Makefile b/sysutils/arc_summary/Makefile
	--- a/sysutils/arc_summary/Makefile
	+++ b/sysutils/arc_summary/Makefile
	@@ -1,10 +1,8 @@
	PORTNAME= arc_summary
	PORTVERSION= 20231114
	CATEGORIES= sysutils
	-MASTER_SITES= https://cgit.freebsd.org/src/plain/sys/contrib/openzfs/cmd/ \
	- https://cgit.freebsd.org/src/plain/sys/contrib/openzfs/cmd/arc_summary/:13
	-DISTFILES= ${PORTNAME}3?h=releng/13.2:13 \
	- ${PORTNAME}?h=releng/14.0 \
	+MASTER_SITES= https://cgit.freebsd.org/src/plain/sys/contrib/openzfs/cmd/
	+DISTFILES= ${PORTNAME}?h=releng/14.0 \
	${PORTNAME}

	MAINTAINER= jrm@FreeBSD.org
	@@ -27,9 +25,7 @@
	.include <bsd.port.pre.mk>

	do-extract:
	-.if ${OSVERSION} < 1400000
	- ${CP} ${DISTDIR}/${PORTNAME}3?h=releng/13.2 ${WRKSRC}/${PORTNAME}
	-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
	${CP} ${DISTDIR}/${PORTNAME}?h=releng/14.0 ${WRKSRC}/${PORTNAME}
	.else
	${CP} ${DISTDIR}/${PORTNAME} ${WRKSRC}/${PORTNAME}
	diff --git a/sysutils/arc_summary/distinfo b/sysutils/arc_summary/distinfo
	--- a/sysutils/arc_summary/distinfo
	+++ b/sysutils/arc_summary/distinfo
	@@ -1,6 +1,4 @@
	TIMESTAMP = 1702600566
	-SHA256 (arc_summary3?h=releng/13.2) = 978d3743bc99a936c05418e3f08d6041535214196d081a6c87938c01a7936da2
	-SIZE (arc_summary3?h=releng/13.2) = 34365
	SHA256 (arc_summary?h=releng/14.0) = 81fc104da57777f45c931c9c2f425f1fe219d12dc61a9d2928a1b03561f9aecb
	SIZE (arc_summary?h=releng/14.0) = 37272
	SHA256 (arc_summary) = 44e8d4aec6614aacfece3a12a6953e0f68b4358fa9621415f25200b346020132
	diff --git a/sysutils/barrier/Makefile b/sysutils/barrier/Makefile
	--- a/sysutils/barrier/Makefile
	+++ b/sysutils/barrier/Makefile
	@@ -39,7 +39,7 @@

	.include <bsd.port.options.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092
	+.if ${OPSYS} == FreeBSD
	EXTRA_PATCHES= ${PATCHDIR}/extra-patch-src_lib_net_SecureUtils.cpp
	.endif

	diff --git a/sysutils/bhyvemgr/Makefile b/sysutils/bhyvemgr/Makefile
	--- a/sysutils/bhyvemgr/Makefile
	+++ b/sysutils/bhyvemgr/Makefile
	@@ -34,7 +34,7 @@
	ONLY_FOR_ARCHS= aarch64 amd64
	.endif

	-.if ${OPSYS} == FreeBSD && (${OSVERSION} >= 1403000)
	+.if ${OPSYS} == FreeBSD
	RUN_DEPENDS+= swtpm>0:sysutils/swtpm
	.endif

	diff --git a/sysutils/cmogstored/Makefile b/sysutils/cmogstored/Makefile
	--- a/sysutils/cmogstored/Makefile
	+++ b/sysutils/cmogstored/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= GPLv3+
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= failst to compile: fdmap.c:89: undefined reference to `__sync_add_and_fetch_4'
	-BROKEN_mips64= failst to compile: fdmap.c:89: undefined reference to `__sync_add_and_fetch_4'
	-
	USES= compiler:c11

	PLIST_FILES= sbin/cmogstored \
	diff --git a/sysutils/deskflow/Makefile b/sysutils/deskflow/Makefile
	--- a/sysutils/deskflow/Makefile
	+++ b/sysutils/deskflow/Makefile
	@@ -12,8 +12,6 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= requires OpenSSL 3.0
	-
	BUILD_DEPENDS= googletest>0:devel/googletest \
	help2man:misc/help2man
	LIB_DEPENDS= libei.so:x11/libei \
	diff --git a/sysutils/dmidecode/Makefile b/sysutils/dmidecode/Makefile
	--- a/sysutils/dmidecode/Makefile
	+++ b/sysutils/dmidecode/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 riscv64 riscv64sf
	+ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 riscv64

	USES= tar:xz

	diff --git a/sysutils/flashrom/Makefile b/sysutils/flashrom/Makefile
	--- a/sysutils/flashrom/Makefile
	+++ b/sysutils/flashrom/Makefile
	@@ -12,7 +12,6 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/COPYING

	-IGNORE_FreeBSD_13= Requires OpenSSL 3+
	NOT_FOR_ARCHS= riscv64
	NOT_FOR_ARCHS_REASON= Unable to determine endianness.

	diff --git a/sysutils/fluent-bit/Makefile b/sysutils/fluent-bit/Makefile
	--- a/sysutils/fluent-bit/Makefile
	+++ b/sysutils/fluent-bit/Makefile
	@@ -9,9 +9,6 @@

	LICENSE= APACHE20

	-BROKEN_mips= fails to build: conflicting types for 'restrict'
	-BROKEN_mips64= fails to build: conflicting types for 'restrict'
	-
	LIB_DEPENDS= libyaml.so:textproc/libyaml

	USES= bison cmake:noninja compiler:c11 gmake localbase:ldflags
	diff --git a/sysutils/fwupd/Makefile b/sysutils/fwupd/Makefile
	--- a/sysutils/fwupd/Makefile
	+++ b/sysutils/fwupd/Makefile
	@@ -7,8 +7,6 @@

	LICENSE= LGPL21

	-BROKEN_FreeBSD_13= requires at least FreeBSD 14
	-
	BUILD_DEPENDS= blkid:filesystems/libblkid \
	flashrom>0:sysutils/flashrom \
	help2man:misc/help2man \
	diff --git a/sysutils/inxi/Makefile b/sysutils/inxi/Makefile
	--- a/sysutils/inxi/Makefile
	+++ b/sysutils/inxi/Makefile
	@@ -40,7 +40,7 @@

	.include <bsd.port.options.mk>

	-.if ${ARCH} == aarch64 \|\| ${ARCH} == amd64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| ${ARCH} == riscv64 \|\| ${ARCH} == riscv64sf
	+.if ${ARCH} == aarch64 \|\| ${ARCH} == amd64 \|\| ${ARCH} == armv6 \|\| ${ARCH} == armv7 \|\| ${ARCH} == i386 \|\| ${ARCH} == riscv64
	RUN_DEPENDS+= dmidecode:sysutils/dmidecode
	.endif

	diff --git a/sysutils/mbgtools/Makefile b/sysutils/mbgtools/Makefile
	--- a/sysutils/mbgtools/Makefile
	+++ b/sysutils/mbgtools/Makefile
	@@ -10,8 +10,6 @@

	LICENSE= BSD2CLAUSE

	-BROKEN_mips64= fails to compile: unused variables
	-
	USES= kmod uidfix
	USE_RC_SUBR= mbgsvcd

	diff --git a/sysutils/nut-devel/Makefile b/sysutils/nut-devel/Makefile
	--- a/sysutils/nut-devel/Makefile
	+++ b/sysutils/nut-devel/Makefile
	@@ -45,7 +45,6 @@
	OPTIONS_DEFAULT_powerpc64= FREEIPMI
	OPTIONS_DEFAULT_powerpc64le= FREEIPMI
	OPTIONS_DEFAULT_riscv64= FREEIPMI
	-OPTIONS_DEFAULT_riscv64sf= FREEIPMI
	OPTIONS_DEFINE= SERIAL USB SNMP NEON PDU MODBUS CGI BASH AVAHI IPMIPSU FREEIPMI DOCS MANPAGES DEV
	OPTIONS_SINGLE= SSL
	OPTIONS_SINGLE_SSL= SSL_OFF OPENSSL NSS
	diff --git a/sysutils/nut/Makefile b/sysutils/nut/Makefile
	--- a/sysutils/nut/Makefile
	+++ b/sysutils/nut/Makefile
	@@ -37,7 +37,6 @@
	OPTIONS_DEFAULT_powerpc64= FREEIPMI
	OPTIONS_DEFAULT_powerpc64le= FREEIPMI
	OPTIONS_DEFAULT_riscv64= FREEIPMI
	-OPTIONS_DEFAULT_riscv64sf= FREEIPMI
	OPTIONS_DEFINE= SERIAL USB SNMP NEON PDU MODBUS CGI BASH AVAHI IPMIPSU FREEIPMI DOCS MANPAGES DEV
	OPTIONS_SINGLE= IPMI SSL
	OPTIONS_SINGLE_SSL= SSL_OFF OPENSSL NSS
	diff --git a/sysutils/p5-Unix-Processors/Makefile b/sysutils/p5-Unix-Processors/Makefile
	--- a/sysutils/p5-Unix-Processors/Makefile
	+++ b/sysutils/p5-Unix-Processors/Makefile
	@@ -11,9 +11,6 @@
	LICENSE= ART10 GPLv1+
	LICENSE_COMB= dual

	-BROKEN_mips= fails to compile: sys/systeminfo.h: No such file or directory
	-BROKEN_mips64= fails to compile: sys/systeminfo.h: No such file or directory
	-
	USES= perl5
	USE_PERL5= configure

	diff --git a/sysutils/py-pywatchman/Makefile b/sysutils/py-pywatchman/Makefile
	--- a/sysutils/py-pywatchman/Makefile
	+++ b/sysutils/py-pywatchman/Makefile
	@@ -12,9 +12,6 @@
	LICENSE= BSD3CLAUSE MIT
	LICENSE_COMB= multi

	-BROKEN_mips= depends on watchman, which needs c++11-libs
	-BROKEN_mips64= depends on watchman, which needs c++11-libs
	-
	RUN_DEPENDS= watchman>=4:sysutils/watchman

	USES= python
	diff --git a/sysutils/radeontop/Makefile b/sysutils/radeontop/Makefile
	--- a/sysutils/radeontop/Makefile
	+++ b/sysutils/radeontop/Makefile
	@@ -10,7 +10,7 @@

	LICENSE= GPLv3

	-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips mips64 riscv64
	+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
	NOT_FOR_ARCHS_REASON= fails to compile: fatal error: amdgpu_drm.h file not found

	LIB_DEPENDS= libpciaccess.so:devel/libpciaccess \
	diff --git a/sysutils/runit/Makefile b/sysutils/runit/Makefile
	--- a/sysutils/runit/Makefile
	+++ b/sysutils/runit/Makefile
	@@ -12,9 +12,6 @@
	LICENSE= BSD3CLAUSE
	LICENSE_FILE= ${WRKSRC}/package/COPYING

	-BROKEN_mips= fails to install: runit-init failed
	-BROKEN_mips64= fails to install: runit-init failed
	-
	USES= cpe

	USE_RC_SUBR= runsvdir
	diff --git a/sysutils/slurm-wlm/Makefile b/sysutils/slurm-wlm/Makefile
	--- a/sysutils/slurm-wlm/Makefile
	+++ b/sysutils/slurm-wlm/Makefile
	@@ -11,7 +11,7 @@
	LICENSE= GPLv2+
	LICENSE_FILE= ${WRKSRC}/COPYING

	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
	NOT_FOR_ARCHS_REASON= 32-bit support is deprecated

	LIB_DEPENDS= libhttp_parser.so:www/http-parser \
	diff --git a/sysutils/tmux/Makefile b/sysutils/tmux/Makefile
	--- a/sysutils/tmux/Makefile
	+++ b/sysutils/tmux/Makefile
	@@ -10,7 +10,7 @@
	LICENSE= ISCL
	LICENSE_FILE= ${WRKSRC}/COPYING

	-USES= cpe pkgconfig
	+USES= cpe ncurses pkgconfig
	CPE_VENDOR= tmux_project

	GNU_CONFIGURE= yes
	@@ -37,15 +37,6 @@
	UTF8PROC_USES= localbase
	UTF8PROC_CONFIGURE_ENABLE= utf8proc

	-.include <bsd.port.pre.mk>
	-
	-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1401502 \|\| ${OSVERSION} >= 1500000 && \
	- ${OSVERSION} < 1500020)
	-USES+= ncurses:port
	-.else
	-USES+= ncurses
	-.endif
	-
	post-patch:
	@${REINPLACE_CMD} -e 's\|/etc/tmux.conf\|${PREFIX}/etc/tmux.conf\|g' \
	${PATCH_WRKSRC}/CHANGES ${PATCH_WRKSRC}/tmux.h
	@@ -63,4 +54,4 @@
	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
	${INSTALL_DATA} ${WRKSRC}/example* ${STAGEDIR}${EXAMPLESDIR}

	-.include <bsd.port.post.mk>
	+.include <bsd.port.mk>
	diff --git a/sysutils/twa-kmod/Makefile b/sysutils/twa-kmod/Makefile
	--- a/sysutils/twa-kmod/Makefile
	+++ b/sysutils/twa-kmod/Makefile
	@@ -10,7 +10,6 @@

	ONLY_FOR_ARCHS= amd64
	ONLY_FOR_ARCHS_REASON= not yet tested on non amd64
	-IGNORE_FreeBSD_13= included in base system
	IGNORE_FreeBSD_15= not supported on FreeBSD 15.x

	USES= kmod uidfix
	diff --git a/sysutils/watchman/Makefile b/sysutils/watchman/Makefile
	--- a/sysutils/watchman/Makefile
	+++ b/sysutils/watchman/Makefile
	@@ -10,9 +10,6 @@

	LICENSE= APACHE20

	-BROKEN_mips= fails to build: watchman.h:169: undefined reference to '__sync_add_and_fetch_8'
	-BROKEN_mips64= fails to build: watchman.h:169: undefined reference to '__sync_add_and_fetch_8'
	-
	BUILD_DEPENDS= ${LOCALBASE}/include/sys/inotify.h:devel/libinotify

	USE_GITHUB= yes
	diff --git a/sysutils/zidrav/Makefile b/sysutils/zidrav/Makefile
	--- a/sysutils/zidrav/Makefile
	+++ b/sysutils/zidrav/Makefile
	@@ -28,7 +28,7 @@
	CFLAGS+= -Dcrc32_type=int
	.endif

	-.if ${ARCH} == mips \|\| ${ARCH} == mipshf \|\| ${ARCH} == mipsn32 \|\| ${ARCH} == mips64 \|\| ${ARCH} == mips64hf \|\| ${ARCH} == powerpc \|\| ${ARCH} == powerpcspe \|\| ${ARCH} == powerpc64
	+.if ${ARCH} == powerpc \|\| ${ARCH} == powerpcspe \|\| ${ARCH} == powerpc64
	CFLAGS+= -DCPU_BIGENDIAN
	.endif

	diff --git a/sysutils/zogftw/Makefile b/sysutils/zogftw/Makefile
	--- a/sysutils/zogftw/Makefile
	+++ b/sysutils/zogftw/Makefile
	@@ -12,8 +12,7 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE

	RUN_DEPENDS= mbuffer:misc/mbuffer
	-TEST_DEPENDS= atf-sh:devel/atf \
	- kyua:devel/kyua
	+TEST_DEPENDS= atf-sh:devel/atf

	USES= sudo
	NO_BUILD= yes
	@@ -32,6 +31,6 @@
	${INSTALL_MAN} ${WRKSRC}/zogftw.8 ${STAGEDIR}${PREFIX}/share/man/man8

	do-test:
	- ${SETENV} HOME=${WRKDIR} ${LOCALBASE}/bin/kyua test --kyuafile ${WRKSRC}/tests/Kyuafile
	+ ${SETENV} HOME=${WRKDIR} kyua test --kyuafile ${WRKSRC}/tests/Kyuafile

	.include <bsd.port.mk>
	diff --git a/textproc/es-hunspell/Makefile b/textproc/es-hunspell/Makefile
	--- a/textproc/es-hunspell/Makefile
	+++ b/textproc/es-hunspell/Makefile
	@@ -17,8 +17,6 @@
	LICENSE_FILE_LGPL3= ${WRKSRC}/LGPLv3.txt
	LICENSE_FILE_MPL11= ${WRKSRC}/MPL-1.1.txt

	-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
	-
	NO_ARCH= yes
	NO_BUILD= yes
	NO_WRKSUBDIR= yes
	diff --git a/textproc/es-hyphen/Makefile b/textproc/es-hyphen/Makefile
	--- a/textproc/es-hyphen/Makefile
	+++ b/textproc/es-hyphen/Makefile
	@@ -18,8 +18,6 @@
	LICENSE_FILE_LGPL3= ${WRKSRC}/LGPLv3.txt
	LICENSE_FILE_MPL11= ${WRKSRC}/MPL-1.1.txt

	-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
	-
	NO_ARCH= yes
	NO_BUILD= yes
	NO_WRKSUBDIR= yes
	diff --git a/textproc/htmldoc/Makefile b/textproc/htmldoc/Makefile
	--- a/textproc/htmldoc/Makefile
	+++ b/textproc/htmldoc/Makefile
	@@ -10,8 +10,6 @@
	LICENSE= GPLv2
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= complains about expecting ) before png_ptr
	-
	LIB_DEPENDS= libcups.so:print/cups \
	libpng16.so:graphics/png

	diff --git a/textproc/kmfl-european-latin/Makefile b/textproc/kmfl-european-latin/Makefile
	--- a/textproc/kmfl-european-latin/Makefile
	+++ b/textproc/kmfl-european-latin/Makefile
	@@ -31,7 +31,7 @@

	.include <bsd.port.pre.mk>

	-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079
	+.if ${OPSYS} == FreeBSD
	BASE64= /usr/bin/base64
	.else
	BUILD_DEPENDS= base64:converters/base64
	diff --git a/textproc/libucl/Makefile b/textproc/libucl/Makefile
	--- a/textproc/libucl/Makefile
	+++ b/textproc/libucl/Makefile
	@@ -10,9 +10,6 @@
	LICENSE= BSD2CLAUSE
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_mips= fails to link: undefined reference to '__sync_add_and_fetch_4'
	-BROKEN_mips64= fails to link: undefined reference to '__sync_add_and_fetch_4'
	-
	USES= autoreconf gmake libtool pathfix pkgconfig
	USE_GITHUB= yes
	GH_ACCOUNT= vstakhov
	diff --git a/textproc/nunnimcax/Makefile b/textproc/nunnimcax/Makefile
	--- a/textproc/nunnimcax/Makefile
	+++ b/textproc/nunnimcax/Makefile
	@@ -22,7 +22,7 @@

	.include <bsd.port.options.mk>

	-.if defined(NOPROFILE) \|\| defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
	+.if defined(NOPROFILE) \|\| defined(NO_PROFILE) \|\| ( ${OPSYS} == FreeBSD)
	PLIST_SUB+= PROFILE="@comment "
	.else
	PLIST_SUB+= PROFILE=""
	diff --git a/textproc/py-ufal.udpipe/Makefile b/textproc/py-ufal.udpipe/Makefile
	--- a/textproc/py-ufal.udpipe/Makefile
	+++ b/textproc/py-ufal.udpipe/Makefile
	@@ -12,7 +12,7 @@
	LICENSE= MPL20
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
	+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
	NOT_FOR_ARCHS_REASON= Only little endian systems are supported!

	USES= compiler:c++11-lang python
	diff --git a/www/bozohttpd/Makefile b/www/bozohttpd/Makefile
	--- a/www/bozohttpd/Makefile
	+++ b/www/bozohttpd/Makefile
	@@ -61,7 +61,7 @@
	CFLAGS+= -Wno-error=unused-but-set-variable
	.endif

	-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) \|\| ${SSL_DEFAULT:Mopenssl3*}
	CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
	.endif

	diff --git a/www/cpp-httplib/Makefile b/www/cpp-httplib/Makefile
	--- a/www/cpp-httplib/Makefile
	+++ b/www/cpp-httplib/Makefile
	@@ -10,8 +10,6 @@
	LICENSE= MIT
	LICENSE_FILE= ${WRKSRC}/LICENSE

	-BROKEN_FreeBSD_13= configure fails: OpenSSL is too old: Found unsuitable version "1.1.1t", but required is at least "3.0.0"
	-
	TEST_DEPENDS= gmake:devel/gmake

	USES= cmake localbase:ldflags python:test # localbase only for tests
	diff --git a/www/gatling/Makefile b/www/gatling/Makefile
	--- a/www/gatling/Makefile
	+++ b/www/gatling/Makefile
	@@ -10,9 +10,6 @@

	LICENSE= GPLv2

	-BROKEN_mips= fails to compile: dirfd.c: error: expected ';', ',' or ')' before 'key'
	-BROKEN_mips64= fails to compile: dirfd.c: error: expected ';', ',' or ')' before 'key'
	-
	BUILD_DEPENDS= libowfat>=0.32:devel/libowfat

	USES= compiler:c++11-lang gmake localbase:ldflags ssl tar:xz
	diff --git a/www/mod_auth_gssapi/Makefile b/www/mod_auth_gssapi/Makefile
	--- a/www/mod_auth_gssapi/Makefile
	+++ b/www/mod_auth_gssapi/Makefile
	@@ -27,13 +27,11 @@
	PLIST_SUB= APMOD_FILE=${APMOD_FILE}

	OPTIONS_DEFAULT= ${OPTIONS_DEFAULT_${OPSYS}_${OSREL:R}}
	-OPTIONS_DEFAULT_FreeBSD_13= GSSAPI_MIT
	OPTIONS_DEFAULT_FreeBSD_14= GSSAPI_MIT
	OPTIONS_DEFAULT_FreeBSD_15= GSSAPI_BASE
	OPTIONS_DEFAULT_FreeBSD_16= GSSAPI_BASE
	OPTIONS_SINGLE= GSSAPI
	OPTIONS_SINGLE_GSSAPI= GSSAPI_BASE GSSAPI_MIT
	-OPTIONS_EXCLUDE_FreeBSD_13= GSSAPI_BASE
	OPTIONS_EXCLUDE_FreeBSD_14= GSSAPI_BASE

	GSSAPI_BASE_USES= gssapi:flags
	@@ -41,10 +39,6 @@

	.include <bsd.port.options.mk>

	-.if ${PORT_OPTIONS:MGSSAPI_BASE} && ${OPSYS} == FreeBSD && ${OSVERSION} < 1500054
	-IGNORE= the GSSAPI_BASE option needs MIT Kerberos in base
	-.endif
	-
	do-install:
	@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEMODDIR} \
	${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
	diff --git a/www/py-adblock/Makefile b/www/py-adblock/Makefile
	--- a/www/py-adblock/Makefile
	+++ b/www/py-adblock/Makefile
	@@ -17,7 +17,7 @@
	# doesn't support creating 32-bit Python wheels for FreeBSD. Thus save build
	# time and skip the port at a early stage.
	# SEE devel/py-maturin/Makefile
	-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
	+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
	NOT_FOR_ARCHS_REASON= the creation of 32-bit Python wheels is not supported for FreeBSD

	BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}maturin>=0.8.3:devel/py-maturin@${PY_FLAVOR} \
	diff --git a/www/qt5-webengine/Makefile b/www/qt5-webengine/Makefile
	--- a/www/qt5-webengine/Makefile
	+++ b/www/qt5-webengine/Makefile
	@@ -125,7 +125,7 @@
	USES+= nodejs:build,lts
	.endif

	-.if ${ARCH:Mmips} \|\| ${ARCH:Mpowerpc}
	+.if ${ARCH:Mpowerpc*}
	PLIST_SUB+= BE="" LE="@comment "
	.else
	PLIST_SUB+= BE="@comment " LE=""
	@@ -153,7 +153,7 @@
	@${REINPLACE_CMD} -E -e 's\|^(MODULE_VERSION = ).*\|\1${QT5_VERSION}\|' \
	${WRKSRC}/.qmake.conf

	-.if ${ARCH:Mmips} \|\| ${ARCH:Mpowerpc}
	+.if ${ARCH:Mpowerpc*}
	@${REINPLACE_CMD} -e 's/icudtl.dat/icudtb.dat/' \
	${WRKSRC}/src/core/core_module.pro
	.endif
	diff --git a/www/sogo2/Makefile b/www/sogo2/Makefile
	--- a/www/sogo2/Makefile
	+++ b/www/sogo2/Makefile
	@@ -11,7 +11,6 @@

	LICENSE= GPLv2

	-BROKEN_FreeBSD_13= ld: error: duplicate symbol: SOGoMailCoreInfoKeys
	BROKEN_FreeBSD_14= ld: error: duplicate symbol: SOGoMailCoreInfoKeys

	LIB_DEPENDS= libmemcached.so:databases/libmemcached \
	diff --git a/www/tomcat-native2/Makefile b/www/tomcat-native2/Makefile
	--- a/www/tomcat-native2/Makefile
	+++ b/www/tomcat-native2/Makefile
	@@ -11,8 +11,6 @@

	LICENSE= APACHE20

	-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
	-
	LIB_DEPENDS= libapr-1.so:devel/apr1

	USES= java libtool ssl
	diff --git a/www/w3m/Makefile b/www/w3m/Makefile
	--- a/www/w3m/Makefile
	+++ b/www/w3m/Makefile
	@@ -14,8 +14,6 @@
	LICENSE_FILE= ${WRKSRC}/doc/README
	LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept

	-BROKEN_mips64= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
	-
	LIB_DEPENDS= libgc.so:devel/boehm-gc

	USES= cpe iconv pkgconfig perl5 ssl
	diff --git a/x11-toolkits/aquamarine/Makefile b/x11-toolkits/aquamarine/Makefile
	--- a/x11-toolkits/aquamarine/Makefile
	+++ b/x11-toolkits/aquamarine/Makefile
	@@ -36,10 +36,4 @@
	PLIST_SUB= SOVERSION_FULL=${DISTVERSION:C/-.*//} \
	SOVERSION_MAJOR=9

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	.include <bsd.port.mk>
	diff --git a/x11-toolkits/hyprtoolkit/Makefile b/x11-toolkits/hyprtoolkit/Makefile
	--- a/x11-toolkits/hyprtoolkit/Makefile
	+++ b/x11-toolkits/hyprtoolkit/Makefile
	@@ -36,12 +36,6 @@
	PLIST_SUB= SOVERSION_FULL=${DISTVERSION} \
	SOVERSION_MAJOR=5

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	# XXX Drop after FreeBSD 14.* EOL around 2028-11-30
	# https://cgit.freebsd.org/src/commit/?id=3965de642c29
	.if !exists(/usr/include/sys/inotify.h)
	diff --git a/x11-wm/dwm/Makefile b/x11-wm/dwm/Makefile
	--- a/x11-wm/dwm/Makefile
	+++ b/x11-wm/dwm/Makefile
	@@ -11,9 +11,6 @@
	LICENSE_FILE= ${WRKSRC}/LICENSE

	LIB_DEPENDS= libfontconfig.so:x11-fonts/fontconfig
	-# Kyua is not used by the upstream to test. It's only used in the port's
	-# do-test target.
	-TEST_DEPENDS= ${LOCALBASE}/libexec/atf-check:devel/kyua

	USES= xorg
	USE_XORG= x11 xft
	@@ -77,7 +74,7 @@
	${INSTALL_DATA} ${WRKSRC}/README ${STAGEDIR}${DOCSDIR}

	do-test:
	- ${LOCALBASE}/libexec/atf-check -s exit:1 -e match:"dwm-${PORTVERSION}" \
	+ /usr/libexec/atf-check -s exit:1 -e match:"dwm-${PORTVERSION}" \
	${STAGEDIR}${PREFIX}/bin/dwm -v

	.include <bsd.port.mk>
	diff --git a/x11-wm/hyprland/Makefile b/x11-wm/hyprland/Makefile
	--- a/x11-wm/hyprland/Makefile
	+++ b/x11-wm/hyprland/Makefile
	@@ -48,12 +48,6 @@

	WRKSRC= ${WRKDIR}/${PORTNAME}-source

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	# XXX Drop after FreeBSD 14.* EOL around 2028-11-30
	# https://cgit.freebsd.org/src/commit/?id=3965de642c29
	.if !exists(/usr/include/sys/inotify.h)
	diff --git a/x11-wm/sway/Makefile b/x11-wm/sway/Makefile
	--- a/x11-wm/sway/Makefile
	+++ b/x11-wm/sway/Makefile
	@@ -54,9 +54,7 @@
	.include <bsd.port.options.mk>

	# https://github.com/freebsd/freebsd-src/pull/1675
	-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305503 \
	- \|\| ${OSVERSION} >= 1400000 && ${OSVERSION} < 1403505 \
	- \|\| ${OSVERSION} >= 1500000 && ${OSVERSION} < 1500052)
	+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403505
	EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-wordexp
	.endif

	diff --git a/x11-wm/swayfx/Makefile b/x11-wm/swayfx/Makefile
	--- a/x11-wm/swayfx/Makefile
	+++ b/x11-wm/swayfx/Makefile
	@@ -57,9 +57,7 @@
	.include <bsd.port.options.mk>

	# https://github.com/freebsd/freebsd-src/pull/1675
	-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305503 \
	- \|\| ${OSVERSION} >= 1400000 && ${OSVERSION} < 1403505 \
	- \|\| ${OSVERSION} >= 1500000 && ${OSVERSION} < 1500052)
	+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403505
	EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-wordexp
	.endif

	diff --git a/x11/contour/Makefile b/x11/contour/Makefile
	--- a/x11/contour/Makefile
	+++ b/x11/contour/Makefile
	@@ -50,11 +50,6 @@
	EXTRA_PATCHES= ${PATCHDIR}/extra-patch-src_crispy_read__selector.h
	.endif

	-# FreeBSD 13 does not have tic in base, so we need one from ports
	-.if ${OPSYS} == FreeBSD && ${OSREL:R} == 13
	-BUILD_DEPENDS+= tic:devel/ncurses
	-.endif
	-
	.if ${ARCH:Mpowerpc*}
	USES+= compiler:gcc-c++11-lib
	.endif
	diff --git a/x11/kde-gear/Makefile b/x11/kde-gear/Makefile
	--- a/x11/kde-gear/Makefile
	+++ b/x11/kde-gear/Makefile
	@@ -12,7 +12,6 @@
	OPTIONS_DEFINE= KDEADMIN KDEEDU KDEGAMES KDEGRAPHICS KDEMULTIMEDIA KDENETWORK \
	KDEPIM KDEUTILS
	OPTIONS_DEFAULT=${OPTIONS_DEFINE}
	-OPTIONS_EXCLUDE_FreeBSD_13= KDEPIM # OpenSSL 1.1.x is not supported

	KDEADMIN_DESC= Administration utilities
	KDEADMIN_RUN_DEPENDS= kdeadmin>=${KDE_APPLICATIONS_VERSION}:sysutils/kdeadmin
	diff --git a/x11/kitty/Makefile b/x11/kitty/Makefile
	--- a/x11/kitty/Makefile
	+++ b/x11/kitty/Makefile
	@@ -38,9 +38,10 @@
	libxkbcommon.so:x11/libxkbcommon \
	libxxhash.so:devel/xxhash

	+# ncursesw and tinfo >= 6.1 seem to be needed
	USES= compiler:c11 cpe desktop-file-utils gettext-runtime gl gmake \
	- go:modules,1.26 magick pkgconfig python shebangfix ssl tar:xz \
	- terminfo xorg
	+ go:modules,1.26 magick ncurses pkgconfig python shebangfix ssl \
	+ tar:xz terminfo xorg
	CPE_VENDOR= kitty_project

	USE_GL= gl
	@@ -84,13 +85,6 @@
	MAKE_ENV+= KITTY_NO_LTO=1
	.endif

	-# ncursesw and tinfo >= 6.1 seem to be neededd
	-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400035
	-USES+= ncurses:port
	-.else
	-USES+= ncurses
	-.endif
	-
	# PR291485
	# Temporarily disable build/installation of docs and man pages on FreeBSD >= 15.0
	# See:
	diff --git a/x11/nvidia-kmod/Makefile b/x11/nvidia-kmod/Makefile
	--- a/x11/nvidia-kmod/Makefile
	+++ b/x11/nvidia-kmod/Makefile
	@@ -187,12 +187,10 @@
	${WRKSRC}/src/${NVSRC}/nvidia_dev.c
	.endif
	# After src 2a99dd30dfaa, DRIVER_MODULE should not include nvidia_devclass
	-.if ${OSVERSION} >= 1400058
	${REINPLACE_CMD} -e '/^DRIVER_MODULE/s/, nvidia_devclass//' \
	${WRKSRC}/src/${NVSRC}/nvidia_pci.c
	-.endif
	# Catch up with pmap_unmapdev() and kmem_*() changes in 14-CURRENT
	-.if ${OSVERSION} >= 1400070 && (${NVVERSION} < 470.25602 \|\| ${NVVERSION} >= 480.00000 && ${NVVERSION} < 530.03002)
	+.if ${NVVERSION} < 470.25602 \|\| ${NVVERSION} >= 480.00000 && ${NVVERSION} < 530.03002
	${REINPLACE_CMD} -e '/pmap_unmapdev/s,(vm_offset_t),,' \
	${WRKSRC}/src/${NVSRC}/nvidia_os.c
	${REINPLACE_CMD} -e '/vm_offset_t virtual_address/s,vm_offset_t ,char *,' \
	diff --git a/x11/pixman/Makefile b/x11/pixman/Makefile
	--- a/x11/pixman/Makefile
	+++ b/x11/pixman/Makefile
	@@ -13,7 +13,8 @@
	USES= cpe meson pkgconfig tar:xz
	MESON_ARGS= -Dloongson-mmi=disabled \
	-Dgtk=disabled \
	- -Ddemos=disabled
	+ -Ddemos=disabled \
	+ -Dmips-dspr2=disabled

	OPTIONS_DEFINE= OPENMP TEST
	OPTIONS_DEFAULT= OPENMP
	@@ -52,11 +53,6 @@
	-Dsse2=disabled \
	-Dssse3=disabled
	.endif
	-.if ${ARCH:Mmips*}
	-MESON_ARGS+= -Dmips-dspr2=enabled
	-.else
	-MESON_ARGS+= -Dmips-dspr2=disabled
	-.endif
	.if ${ARCH:Mpowerpc*}
	MESON_ARGS+= -Dvmx=enabled
	.else
	diff --git a/x11/squeekboard/Makefile b/x11/squeekboard/Makefile
	--- a/x11/squeekboard/Makefile
	+++ b/x11/squeekboard/Makefile
	@@ -14,8 +14,6 @@
	LICENSE= GPLv3
	LICENSE_FILE= ${WRKSRC}/COPYING

	-BROKEN_FreeBSD_13_powerpc64= fails to link: ld: error: undefined symbol: eekboard_context_service_get_overlay
	-
	BUILD_DEPENDS= wayland-protocols>=1.12:graphics/wayland-protocols
	LIB_DEPENDS= libfeedback-0.0.so:accessibility/feedbackd \
	libwayland-client.so:graphics/wayland \
	diff --git a/x11/swayimg/Makefile b/x11/swayimg/Makefile
	--- a/x11/swayimg/Makefile
	+++ b/x11/swayimg/Makefile
	@@ -35,12 +35,6 @@
	LIB_DEPENDS+= libinotify.so:devel/libinotify
	.endif

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	OPTIONS_DEFINE= AVIF BASH GIF HEIF JPEG JSON JXL LIBEXIF LIBRSVG2 \
	OPENEXR PNG RAW SIXEL TIFF WEBP ZSH
	OPTIONS_DEFAULT=AVIF BASH DRM GIF HEIF JPEG JSON JXL LIBEXIF LIBRSVG2 \
	diff --git a/x11/wmenu/Makefile b/x11/wmenu/Makefile
	--- a/x11/wmenu/Makefile
	+++ b/x11/wmenu/Makefile
	@@ -18,14 +18,6 @@
	USES= compiler:c11 gnome meson pkgconfig
	USE_GNOME= cairo pango

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-CPPFLAGS+= `pkg-config --cflags epoll-shim`
	-LDFLAGS+= `pkg-config --libs epoll-shim`
	-.endif
	-
	WRKSRC= ${WRKDIR}/${PORTNAME}

	PLIST_FILES= bin/wmenu \
	diff --git a/x11/xdg-desktop-portal-wlr/Makefile b/x11/xdg-desktop-portal-wlr/Makefile
	--- a/x11/xdg-desktop-portal-wlr/Makefile
	+++ b/x11/xdg-desktop-portal-wlr/Makefile
	@@ -30,12 +30,6 @@
	share/dbus-1/services/org.freedesktop.impl.portal.desktop.wlr.service \
	share/xdg-desktop-portal/portals/wlr.portal

	-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
	-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
	-.if !exists(/usr/include/sys/timerfd.h)
	-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
	-.endif
	-
	OPTIONS_DEFINE= MANPAGES
	OPTIONS_DEFAULT=MANPAGES

	diff --git a/x11/xfce4-goodies/Makefile b/x11/xfce4-goodies/Makefile
	--- a/x11/xfce4-goodies/Makefile
	+++ b/x11/xfce4-goodies/Makefile
	@@ -27,7 +27,6 @@
	OPTIONS_EXCLUDE_powerpc64le= BATTERY
	OPTIONS_EXCLUDE_powerpcspe= BATTERY
	OPTIONS_EXCLUDE_riscv64= BATTERY
	-OPTIONS_EXCLUDE_riscv64sf= BATTERY

	OPTIONS_GROUP= APPLICATIONS PANELPLUGINS THUNARPLUGINS UNOFFICIAL

File Metadata

Mime Type: text/plain
Expires: Fri, May 15, 9:40 AM (22 h, 33 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 33079651
Default Alt Text: D55624.id174733.largetrue.diff (429 KB)

D55624.id174733.largetrue.diffNo OneTemporaryActions

D55624.id174733.largetrue.diffView Options

File Metadata

Event Timeline

D55624.id174733.largetrue.diff
No OneTemporary
Actions

D55624.id174733.largetrue.diff
View Options