FreeBSD/src 143da26 — sys/kern vfs_syscalls.c, sys/sys syscallsubr.h

kern_revoke: remove always UIO_USERSPACE pathseg argument

In FreeBSD and CheriBSD pathseg was always UIO_USERSPACE and when I
extracted the patch for FreeBSD, I failed to propogate it to NAMEI.
Since it's always the same, remove it as needless generality.

Reported by:    netchild
Sponsored by:   Innovate UK
Fixes:          7273d80ba18c ("vfs_syscalls.c: add kern_ and user_ implementations")
DeltaFile
+2-2sys/kern/vfs_syscalls.c
+1-1sys/sys/syscallsubr.h
+3-32 files

FreeBSD/src 973698a — sys/kern kern_time.c

clock_gettime: Add capability mode check

clock_gettime is permitted in capability mode, and it calls get_cputime
if clock_id is negative.  get_cputime did not check the target pid in
capability mode.

Reported by:    llm-postcr
Reviewed by:    markj, Osvaldo Janeri Filho <ojanerif at amd.com>
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61469
DeltaFile
+3-0sys/kern/kern_time.c
+3-01 files

FreeBSD/src 1bb8b1d — sys/kern kern_fork.c

hwpmc: switch in process PMCs on a thread's first run

A new thread starts in fork_exit(), not mi_switch(), so its PMCs are
not loaded until its next context switch.  Call the switch-in hook
there.

Reviewed by:    kib, Osvaldo Janeri Filho <ojanerif at amd.com>, mhorne
MFC after:      1 week
Sponsored by:   Advanced Micro Devices, Inc.
Differential Revision:  https://reviews.freebsd.org/D60565
DeltaFile
+10-0sys/kern/kern_fork.c
+10-01 files

FreeBSD/src 57e8edd — sys/dev/mii lan867xphy.c

lan867xphy: Add silicon rev D0 configuration

Apply hardware revision D0 configuration from Microchip AN1699
(Revision G).  The LSCTL (0x0012) write is deferred until link state
reporting is implemented.

Sponsored by:   The FreeBSD Foundation
Sponsored by:   Microchip (Hardware)
Differential Revision: https://reviews.freebsd.org/D61269
DeltaFile
+31-1sys/dev/mii/lan867xphy.c
+31-11 files

FreeBSD/src e003392 — contrib/blocklist/bin blacklistd.8

blocklist: blacklist: Chase recent upstream changes

MFC after:      3 days
DeltaFile
+19-11contrib/blocklist/bin/blacklistd.8
+19-111 files

FreeBSD/src ea9a38e — contrib/blocklist/bin blocklistd.8, contrib/blocklist/diff named.diff

MFV: Import blocklist 2026-11-12 (590e95e)

Merge commit 'b0788c28c7bc6631129bc366bad491cf5698b2dc'

Changes:

https://github.com/zoulasc/blocklist/compare/10a907f...590e95e

MFC after:      3 days
DeltaFile
+140-195contrib/blocklist/diff/named.diff
+19-11contrib/blocklist/bin/blocklistd.8
+1-1contrib/blocklist/etc/blocklistd.conf
+160-2073 files

FreeBSD/src 76e6737 — contrib/libucl/src ucl_util.c ucl_parser.c, contrib/libucl/tests test_cbor_vectors.c test_empty_chunks.c

libucl: Import libucl 0.10.0

Tested by:      ivy
Approved by:    bapt, ivy
Differential Revision:  https://reviews.freebsd.org/D61099
DeltaFile
+1,437-0contrib/libucl/src/ucl_cbor.c
+992-262contrib/libucl/src/ucl_parser.c
+1,112-0contrib/libucl/tests/test_limits.c
+846-254contrib/libucl/src/ucl_util.c
+964-0contrib/libucl/tests/test_empty_chunks.c
+872-0contrib/libucl/tests/test_cbor_vectors.c
+6,223-51665 files not shown
+13,988-88671 files

FreeBSD/src b0788c2 — bin blocklistd.8, diff named.diff

Vendor import of blocklist 2026-11-12 (590e95e)

Upstream hash 590e95e6a62cc369eefbb684a7340358224f0c96.

Obtained from:  https://github.com/zoulasc/blocklist
DeltaFile
+140-195diff/named.diff
+19-11bin/blocklistd.8
+1-1etc/blocklistd.conf
+160-2073 files

FreeBSD/src fabdac3 — usr.sbin/bhyve/riscv fdt.c

bhyve/riscv: fix PCIe FDT interrupt-map entry stride

In bhyve arm64, each PCIe interrupt-map entry spans 10 cells because the
ARM GIC specifies #interrupt-cells = 3. On RISC-V, the APLIC uses
#interrupt-cells = 2, so each entry spans only 9 cells.

When the PCIe FDT code was originally adapted from arm64, the property
allocation size and cell assignments were reduced to 9 cells per entry,
but the loop multiplier retained the 10-cell stride. This caused the
interrupt-map array to be packed incorrectly with gaps, breaking PCI
interrupt routing in guest operating systems and overflowing the
allocation by 16 cells.

Correct the loop stride to 9 cells so the interrupt map is properly
formed.

Reviewed by:    jrtc27
Fixes:          7ab1a32cd43c ("bhyve/riscv: Initial import")
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D61473
DeltaFile
+9-9usr.sbin/bhyve/riscv/fdt.c
+9-91 files

FreeBSD/src 39b97c1 — sys/net if_geneve.c

if_geneve: Ignore reserved bits on receive

RFC 8926 section 3.4 requires the reserved fields of geneve header
to be ignored on receipt.

While here, remove the needless htons() from the version check, as
geneve_ver is a 2-bit bitfield with no byte order.

Fixes:  e44d2e941e8e ("if_geneve: Add Support for Geneve (RFC8926)")
DeltaFile
+1-3sys/net/if_geneve.c
+1-31 files

FreeBSD/src 7ba9c38 — sys/net if_geneve.c

if_geneve: Do not byte-swap the option length

geneve_optlen is a 6-bit bitfield within a single byte, so it has no
byte order.  Applying ntohs() to it on little-endian machines turned
an option length of 1 into 256, causing every received packet carrying
options to dropped.

PR:             300453
Reviewed by:    pouria
Fixes:  e44d2e941e8e ("if_geneve: Add Support for Geneve (RFC8926)")
DeltaFile
+1-1sys/net/if_geneve.c
+1-11 files

FreeBSD/src 16bdecc — sys/dev/sound/midi mpu401.c

Revert "sound/midi: Drain the mpu401 callout before device teardown"

This was committed to main by accident, but was also buggy.

This reverts commit 91539591d7f8dd8ca24ced875bd16c3ba3c7d201.
DeltaFile
+1-3sys/dev/sound/midi/mpu401.c
+1-31 files

FreeBSD/src 64abec2 — sys/arm/allwinner aw_sid.c

aw_sid: Add support for the H6

Add the SID of the H6.  The efuse starts at 0x200 like on the other
64 bits SoCs and starts with the 16 bytes of the chip ID, which awg(4)
uses to create a MAC address when the firmware did not give it one.

The thermal sensor calibration data is not added, there is no driver
for the thermal sensors of the H6.

Tested on: H6
DeltaFile
+18-0sys/arm/allwinner/aw_sid.c
+18-01 files

FreeBSD/src 8a131d2 — sys/arm/allwinner axp81x.c

axp81x: Honor the enable delay of the regulators

axp8xx_regnode_enable() always reported a delay of 0, so the
regulator-enable-ramp-delay property of the FDT was ignored.  On the
Pine H64 model B the Ethernet PHY is supplied by ALDO2, which has a
delay of 100ms, and awg(4) resets the controller right after enabling
it, before the PHY is ready: the soft reset timed out and the interface
did not attach.  Return the delay when enabling a regulator, like the
fixed regulator driver does.

Fixes:          c175fd0fe8a3 ("axp81x: Add support for AXP803")
Tested on: H6
DeltaFile
+3-2sys/arm/allwinner/axp81x.c
+3-21 files

FreeBSD/src deedeb1 — sys/arm/allwinner if_awg.c

awg: Use the MAC address of the FDT

The firmware gives the MAC address of the controller in the FDT, in the
mac-address or local-mac-address property.  awg(4) only used the address
in the registers, which is set when the firmware used the controller,
and the one created from the SID.  On the Pine H64 the firmware does not
initialise the Ethernet and the SID driver does not support the H6, so a
random address was created and it changed at every boot.

Use fdt_ether_get_addr(), it takes the address of the FDT and keeps the
current one when there is none.

Tested on: H6
DeltaFile
+5-0sys/arm/allwinner/if_awg.c
+5-01 files

FreeBSD/src 9153959 — sys/dev/sound/midi mpu401.c

sound/midi: Drain the mpu401 callout before device teardown

midi_uninit() frees the snd_midi that mpu401_intr() reaches through
midi_in() and midi_out(), but the callout that calls it was drained
afterwards. Drain it first, and clear M_TXPEND so that a firing handler
does not re-arm itself.

Fixes:          f960b33d35da ("sound/midi: Drain the mpu401 callout")
MFC with:       f960b33d35da
Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-1sys/dev/sound/midi/mpu401.c
+3-11 files

FreeBSD/src acd270c — tests/sys/kern module_test.c

modstat: check errno before calling feature_present

feature_present will overwrite errno if COMPAT_FREEBSD13 is not present.

Reported by:    llm-postcr
Fixes:          ef726c645300 ("modstat: allow compat support to fail in tests")
DeltaFile
+1-1tests/sys/kern/module_test.c
+1-11 files

FreeBSD/src 70cf77e — sys/kern vfs_aio.c

aio_cancel(2): add kern_aio_cancel

Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284
DeltaFile
+14-5sys/kern/vfs_aio.c
+14-51 files

FreeBSD/src 9506d8e — sys/vm swap_pager.c

swapoff: don't leak vnode pointer to device

After looking up the device path, we compare the vnode to the vnode of
each swap device.  Prior to this change we leaked a vnode reference to
the device we're trying to remove from the swap pool.

Effort:         CHERI upstreaming
Reviewed by:    kib, markj
Reported by:    llm-postcr
MFC after:      3 days
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D61464
DeltaFile
+1-0sys/vm/swap_pager.c
+1-01 files

FreeBSD/src 118067f — sys/kern vfs_extattr.c

extattr_list*: avoid panic with absurd buffer lengths

Apply a layered defence:
 - Reject nbytes > IOSIZE_MAX in user_extattr_list_fd and
   user_extattr_list_path.
 - In extattr_list_vp require auiop->uio_resid to be non-negative.

Effort:         CHERI upstreaming
Reviewed by:    markj
Reported by:    llm-postcr
MFC after:      3 days
Sponsored by:   Innovate UK
Fixes:          6453d4240f6b ("vfs: Export exattr methods to reuse by Linuxulator")
Differential Revision:  https://reviews.freebsd.org/D61461
DeltaFile
+7-1sys/kern/vfs_extattr.c
+7-11 files

FreeBSD/src ef726c6 — tests/sys/kern module_test.c

modstat: allow compat support to fail in tests

v1 and v2 versions of stuct module_stat are now gated by COMPAT_ ifdefs
so allow the otherwise valid query to fail with EINVAL.

Effort:         CHERI upstreaming
Reviewed by:    markj
Reported by:    llm-postcr
Sponsored by:   Innovate UK
Fixes:          1ebf46ecb627 ("modstat: don't copyout while holding a lock")
Differential Revision:  https://reviews.freebsd.org/D61460
DeltaFile
+16-8tests/sys/kern/module_test.c
+16-81 files

FreeBSD/src 17802b5 — sys/amd64/vmm x86.h x86.c

amd64/vmm: Don't advertise AMD PerfMonV2 or performance counters

vmm does not handle CPUID leaf 0x80000022, so a FreeBSD guest on a
Family 19h or later host panics on "kldload hwpmc", which trusts the
PerfMonV2 bit and writes AMD_PMC_GLOBAL_CTL.

Tested by:      Osvaldo Janeri Filho <ojanerif at amd.com>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    markj, kib
Differential Revision:  https://reviews.freebsd.org/D61141

(cherry picked from commit 8fb539b081dbfe3e93e607a5d4d36184c53c8aaf)
DeltaFile
+11-0sys/amd64/vmm/x86.c
+1-0sys/amd64/vmm/x86.h
+12-02 files

FreeBSD/src ade540f — sys/amd64/vmm x86.h x86.c

amd64/vmm: Don't advertise AMD PerfMonV2 or performance counters

vmm does not handle CPUID leaf 0x80000022, so a FreeBSD guest on a
Family 19h or later host panics on "kldload hwpmc", which trusts the
PerfMonV2 bit and writes AMD_PMC_GLOBAL_CTL.

Tested by:      Osvaldo Janeri Filho <ojanerif at amd.com>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    markj, kib
Differential Revision:  https://reviews.freebsd.org/D61141

(cherry picked from commit 8fb539b081dbfe3e93e607a5d4d36184c53c8aaf)
DeltaFile
+11-0sys/amd64/vmm/x86.c
+1-0sys/amd64/vmm/x86.h
+12-02 files

FreeBSD/src 03466b1 — sys/netlink netlink_sysevent.c

netlink: Pre-register the missing devctl event systems

devctl_notify() can be called with a mutex held. If the event system is
not listed in devctl_systems[], sysevent_get_group() calls
sysevent_new_group(), which calls strdup() with M_WAITOK, and we may end
up sleeping while holding a non-sleepable mutex.

Add the missing systems.

While here, remove the nonexistent KERNEL system.

PR:             299272
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D61161

(cherry picked from commit 66d078c17294ca2ea225e4926a8cd9697dda57ed)
DeltaFile
+3-1sys/netlink/netlink_sysevent.c
+3-11 files

FreeBSD/src 209af05 — sys/arm/allwinner/a33 a33_padconf.c

allwinner: a33: Fix the pin number of PE17

The PE17 entry of the pad table of the A33 had the pin number 16, the
one of PE16, so the pinctrl of PE17 configured PE16 and a <&pio 4 17>
specifier could not be mapped.

Reported by:    llm-postcr
Fixes:          cf72965fbf02 ("Allwinner: Add A33 support")
DeltaFile
+1-1sys/arm/allwinner/a33/a33_padconf.c
+1-11 files

FreeBSD/src 628d2bc — sys/dev/clk/allwinner ccu_h6_r.c

aw_ccu: h6: Allow the IR and W1 clocks to change their parent

The IR clock was defined without AW_CLK_REPARENT, so only the current
parent was used to find a rate.  The firmware leaves the mux on osc32k,
from which the best rate is 32768Hz, and aw_cir asks for exactly 3MHz,
which osc24M can give.  The request failed and r_ir did not attach.  Do
the same as the main CCU for the CIR-TX clock and let the clock use the
best parent, and do the same for the 1-wire clock which is the same.

Reported by:    llm-postcr
Fixes:          69919babdac7 ("aw_ccu: h6: Add the IR, W1, RSB and RTC clocks of the R CCU")
Tested on: H6
DeltaFile
+4-2sys/dev/clk/allwinner/ccu_h6_r.c
+4-21 files

FreeBSD/src 4866331 — sys/arm/allwinner axp81x.c

axp81x: Fix the number of steps of the first range of DCDC5

The voltage of DCDC5 goes from 800mV to 1120mV in 10mV steps with the
codes 0x00 to 0x20, then from 1140mV to 1840mV in 20mV steps with the
codes 0x21 to 0x44.  The first range has 32 steps and not 42, so every
code above 32 was decoded and encoded wrongly: the driver read 1160mV
for the 1.2V that the firmware sets for the DRAM, did not see it in the
range of the FDT and wrote a code that is really 1280mV.  The same
happens for the other voltages, 1.36V is set to 1.46V and 1.5V to 1.6V.
It also made the voltage reported for the regulator wrong.

Reported by:    llm-postcr
Fixes:          c175fd0fe8a3 ("axp81x: Add support for AXP803")
Tested on: A64
DeltaFile
+1-1sys/arm/allwinner/axp81x.c
+1-11 files

FreeBSD/src b1a3c09 — sys/dev/clk/allwinner ccu_h616.c

aw_ccu: h616: Set the lock enable bit of the PLLs

The lock status bit of a PLL is only updated when its lock enable bit,
bit 29, is set, and the firmware only sets it for the PLLs it uses.
Enabling another PLL, or changing the rate of an enabled one, then
waited for a lock that never came and ended after a second with an
error.  Set the bit on all the PLLs when attaching, like Linux does.

Reported by:    llm-postcr
Fixes:          92b59f3d010d ("aw_clk: Wait for the PLL to lock when enabling it")
DeltaFile
+36-1sys/dev/clk/allwinner/ccu_h616.c
+36-11 files

FreeBSD/src cffbc16 — sys/arm/allwinner axp209.c

axp209: Allow the interrupt handler to sleep

The interrupt handler reads and writes the registers of the PMU with
IIC_INTRWAIT, which can sleep when the bus is busy, and the I2C
controller the AXP209 is on in the A10 and A20 waits for the end of the
transfer.  The handler runs in an interrupt thread, which cannot sleep
unless the interrupt is marked as sleepable, so an interrupt of the PMU
would panic a kernel with INVARIANTS.  Mark it, the interrupt is not
shared, like it was done for the axp81x driver.

Reported by:    llm-postcr
Fixes:          30068a1de9e3 ("Add support for interrupts, sensors and GPIO for AXP209 PMIC")
DeltaFile
+2-1sys/arm/allwinner/axp209.c
+2-11 files

FreeBSD/src 0b6b389 — sys/arm/allwinner/a31 a31s_padconf.c

allwinner: a31s: Fix the pin number of PH28

The PH28 entry of the pad table of the A31s had the pin number 27, the
one of PH27, so the pinctrl of PH28 configured PH27 and a <&pio 7 28>
specifier could not be mapped.  This was fixed for the A31 in
222947a74223 but not in the copy for the A31s.

Reported by:    llm-postcr
Fixes:          ccf8caad1413 ("Add the Allwinner A31 and A31s padconf support. It's currently unused, but")
DeltaFile
+1-1sys/arm/allwinner/a31/a31s_padconf.c
+1-11 files