FreeBSD/src 18a5549lib/msun/amd64 Makefile.inc s_fma_avx.S, lib/msun/src s_fmaf.c s_fma.c

lib/msun amd64: use AVX FMA instructions for fma(3) and fmaf(3) when available

Utilize the ARCHLEVEL framework from libc/amd64/string to provide the
way for runtime selection of the implementation, if wanted.

Reviewed by:    fuz, kfv
Discussed with: kargl
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59462
DeltaFile
+24-0lib/msun/amd64/s_fma_avx.S
+24-0lib/msun/amd64/s_fmaf_avx.S
+10-1lib/msun/src/s_fmaf.c
+10-1lib/msun/src/s_fma.c
+8-1lib/msun/amd64/Makefile.inc
+76-35 files

FreeBSD/src b45fd24lib/msun Makefile

lib/msun: move the calculation of LIBC_SRCTOP earlier

which makes the variable available for machine/Makefile.inc usage.

Reviewed by:    fuz, kfv
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59462
DeltaFile
+5-4lib/msun/Makefile
+5-41 files

FreeBSD/src 4fb4be7usr.bin/sort sort.1.in

sort.1: Fix default memory buffer size

PR:             261496
Fixes:          554442439dd0 ("Change the memory heuristics")
MFC after:      3 days
Reported by:    wosch
DeltaFile
+1-1usr.bin/sort/sort.1.in
+1-11 files

FreeBSD/src ae45851share/misc bsd-family-tree

bsd-family-tree: add NetBSD 9.5 and FreeBSD 14.5
DeltaFile
+41-37share/misc/bsd-family-tree
+41-371 files

FreeBSD/src e0a8be1contrib/expat Changes, contrib/expat/lib xmltok.h xmlparse.c

contrib/expat: import expat 2.8.4

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes

Security:       CVE-2026-66046
Security:       CVE-2026-76641
Security:       CVE-2026-76957
Security:       CVE-2026-76956

(cherry picked from commit f89b0ce5fd0786f5ed306d9cdf6f019942ae0d8a)
DeltaFile
+189-64contrib/expat/lib/xmlparse.c
+79-0contrib/expat/tests/basic_tests.c
+65-0contrib/expat/Changes
+57-1contrib/expat/tests/misc_tests.c
+3-3lib/libexpat/expat_config.h
+2-2contrib/expat/lib/xmltok.h
+395-7010 files not shown
+408-7916 files

FreeBSD/src e9d9d7econtrib/expat Changes, contrib/expat/lib xmltok.h xmlparse.c

contrib/expat: import expat 2.8.4

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes

Security:       CVE-2026-66046
Security:       CVE-2026-76641
Security:       CVE-2026-76957
Security:       CVE-2026-76956

(cherry picked from commit f89b0ce5fd0786f5ed306d9cdf6f019942ae0d8a)
DeltaFile
+189-64contrib/expat/lib/xmlparse.c
+79-0contrib/expat/tests/basic_tests.c
+65-0contrib/expat/Changes
+57-1contrib/expat/tests/misc_tests.c
+3-3lib/libexpat/expat_config.h
+2-2contrib/expat/lib/xmltok.h
+395-7010 files not shown
+408-7916 files

FreeBSD/src f195b9fsys/dev/nvme nvme_ctrlr.c

nvme: limit I/O queue trackers to Identify MAXCMD

MAXCMD is the maximum number of commands the controller processes at
one time for a particular I/O queue. Allocating more trackers than
that only queues commands inside the controller. Controllers
reporting 0 are unaffected.

Approved by: ngie (co-mentor)

Reviewed by:    ngie, imp
Differential Revision:  https://reviews.freebsd.org/D59154
DeltaFile
+7-0sys/dev/nvme/nvme_ctrlr.c
+7-01 files

FreeBSD/src 82f70a0sys/dev/nvme nvme_ctrlr_cmd.c nvme.h

nvme: name the Create I/O queue cdw11 fields, use Medium QPRIO

The Create I/O queue commands carried magic 0x1/0x3 cdw11 values, and
the implicit QPRIO of zero classifies every I/O queue Urgent the
moment weighted round robin arbitration is enabled. No functional
change with the round robin default.

Approved by: ngie (co-mentor)

Reviewed by:    ngie, imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59153
DeltaFile
+14-0sys/dev/nvme/nvme.h
+5-4sys/dev/nvme/nvme_ctrlr_cmd.c
+19-42 files

FreeBSD/src a14a810sys/dev/apple_bce apple_bce_vhci.h apple_bce_vhci.c

bce_vhci: fix duplicate endpoint queue registration, ratelimit failure logging

bce_vhci_endpoint_create() was registering both the IN and OUT
submission queues on every call, regardless of which direction
the endpoint actually needed.
The per-stage firmware registration failures weren't rate-limited,
so a stuck registration will spam the console.

Tested on:
MacBookPro15,2
Macmini8,1
MacBookPro15,3
MacBookPro16,2

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58831
DeltaFile
+134-88sys/dev/apple_bce/apple_bce_vhci.c
+2-0sys/dev/apple_bce/apple_bce_vhci.h
+136-882 files

FreeBSD/src 0e390dfusr.sbin/pw pw.conf.5

pw.conf: Describe better + tag SPDX

MFC after:              3 days
Reported by:            Artem Bunichev <temcbun at gmail.com>
Differential Revision:  https://reviews.freebsd.org/D58329
DeltaFile
+5-2usr.sbin/pw/pw.conf.5
+5-21 files

FreeBSD/src 04f53c5share/man/man4 nvd.4

nvd.4: Canonicalize SYNOPSIS, TUNABLES, tag SPDX

MFC after:      3 days
Event:          Berlin Hackathon 202609
DeltaFile
+13-22share/man/man4/nvd.4
+13-221 files

FreeBSD/src 3c24218lib/libbe libbe.3, lib/libpmc pmc.haswellxeon.3

manpages: Fix author e-mail address formatting

 - consistently use Mt request within Aq.  This makes author
   e-mail addresses clickable in many frontends.
 - @freebsd.org -> @FreeBSD.org
 - (user at host.tld) -> Aq Mt user at host.tld

Event:          Berlin Hackathon 202609
MFC after:      3 days
Reviewed by:    ziaee
Differential Revision:  https://reviews.freebsd.org/D59410

(cherry picked from commit d1c07141dccf8c719067bd3c30c402e4db9a77b3)
DeltaFile
+7-7sys/netinet/libalias/libalias.3
+3-3stand/forth/beastie.4th.8
+3-3sbin/bectl/bectl.8
+3-2sbin/ipfw/ipfw.8
+2-2lib/libpmc/pmc.haswellxeon.3
+2-2lib/libbe/libbe.3
+20-1963 files not shown
+94-9369 files

FreeBSD/src 95e9c3bsys/dev/usb usbdevs

usbdevs: add TP-Link Archer T4U ver 3

USB Vendor:Product 0x2357:0x0115

The data was provided by Pavel Timofeev (timp87 gmail com)
and the device will be supported by rtw88 USB (rtw8822bu.c)
in the future.

MFC after:      3 days
DeltaFile
+1-0sys/dev/usb/usbdevs
+1-01 files

FreeBSD/src 36256f7sys/dev/mlx5/mlx5_ib mlx5_ib_qp.c

mlx5ib: use the hardware Toeplitz id when creating an RSS TIR

create_rss_raw_qp_tir() wrote MLX5_RX_HASH_FUNC_TOEPLITZ (the
userspace ABI flag, value 1) into tirc.rx_hash_fn.  That field takes
the hardware encoding from mlx5_ifc.h, where 1 is INVERTED_XOR8 and
Toeplitz is MLX5_TIRC_RX_HASH_FN_HASH_TOEPLITZ (2).

Reviewed by: kib, slavash
Sponsored by: Nvidia Networking
MFC after: 1 week
DeltaFile
+2-1sys/dev/mlx5/mlx5_ib/mlx5_ib_qp.c
+2-11 files

FreeBSD/src 9273fe8sys/compat/linuxkpi/common/include/linux hrtimer.h, sys/compat/linuxkpi/common/src linux_hrtimer.c

linuxkpi: Add `hrtimer_setup()`

`hrtimer_setup()` replaces `hrtimer_init()` in Linux 6.15. The API and
the role are the same, except:
* it takes the `function` callback as argument
* if `function` is NULL, it assigns a default callback

At the same time, we hide `hrtimer_init()` if LINUXKPI_VERSION is
greater than or equal to 61500 because it was dropped in Linux 6.15.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58757
DeltaFile
+19-0sys/compat/linuxkpi/common/include/linux/hrtimer.h
+17-0sys/compat/linuxkpi/common/src/linux_hrtimer.c
+36-02 files

FreeBSD/src 5fad251sys/compat/linuxkpi/common/include/linux time.h, sys/compat/linuxkpi/common/src linux_timesub.c

linuxkpi: Add `timer64_to_tm()`

The function converts a number of seconds since Epoch to a `struct tm`.
The implementation was copied from `contrib/tzcode/localtime.c`.

The amdgpu DRM driver started to use it in Linux 6.15.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58758
DeltaFile
+183-0sys/compat/linuxkpi/common/src/linux_timesub.c
+19-0sys/compat/linuxkpi/common/include/linux/time.h
+2-0sys/conf/files
+1-0sys/modules/linuxkpi/Makefile
+205-04 files

FreeBSD/src 1771ab2usr.sbin/nfsuserd nfsuserd.c

nfsuserd.c: Fix handling where pw_name/gr_name differ from lookup name

When an NSS backend returns a canonical pw_name or gr_name that differs from
the lookup name supplied by the NFSv4 upcall, nfsuserd stores the successful
mapping in the kernel cache under the canonical name instead of the requested
name.

This causes the retry lookup performed by nfsv4_strtouid() or
nfsv4_strtogid() to miss the newly inserted cache entry, resulting in the
default UID/GID being returned although the NSS lookup itself succeeded.

PR:     296753
Reviewed by:    rmacklem
Tested by:      Emanuel Helms <emanuel at nfv.cc>
MFC after:      2 weeks
DeltaFile
+4-2usr.sbin/nfsuserd/nfsuserd.c
+4-21 files

FreeBSD/src 8ffe241sys/compat/linuxkpi/common/src linux_compat.c linux_page.c

linuxkpi: Fix assertion in `lkpi_vmf_insert_pfn_prot_locked()`

Before this change, the assertion would not catch a page index matching
the end address, even though the end address of a mapping is outside of
that mapping.

While here, add another assertion to catch page indexes outside of the
expected range earlier.

Also, pagefaulting an address outside of the mapping range should return
`VM_FAULT_SIGBUS` instead of panicing.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58194
DeltaFile
+4-1sys/compat/linuxkpi/common/src/linux_page.c
+2-0sys/compat/linuxkpi/common/src/linux_compat.c
+6-12 files

FreeBSD/src 9872af2usr.sbin/gstat gstat.c

gstat: Set errno = 0 before strtoul

The strtoul function sets errno on error, but does not clear it on
success; when using strtoul and checking errno (as one should) for
ERANGE / EINVAL afterwards, it's important to zero errno first.

While here, remove a dead store.

Reviewed by:    phk
Fixes:  4fe8c1b67be0 ("Add error and range checking ... ")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59270

(cherry picked from commit 6ddb10cf6b7f870d749e96d2ae55976b18896f54)
DeltaFile
+1-1usr.sbin/gstat/gstat.c
+1-11 files

FreeBSD/src bf95db1usr.sbin/gstat gstat.c

gstat: Set errno = 0 before strtoul

The strtoul function sets errno on error, but does not clear it on
success; when using strtoul and checking errno (as one should) for
ERANGE / EINVAL afterwards, it's important to zero errno first.

While here, remove a dead store.

Reviewed by:    phk
Fixes:  4fe8c1b67be0 ("Add error and range checking ... ")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59270

(cherry picked from commit 6ddb10cf6b7f870d749e96d2ae55976b18896f54)
DeltaFile
+1-1usr.sbin/gstat/gstat.c
+1-11 files

FreeBSD/src b712bb8sys/netinet tcp_subr.c tcp_usrreq.c

tcp: fix TCPS_CLOSED state underleak in syncache_socket()

The syncache entry holds one TCPS_SYN_RECEIVED count that normally is
transferred to the the newborn tp.  Upon failure syncache_socket() shall
not use TCPSTATES_INC/TCPSTATES_DEC (see 5050df3f4aa4 why).  But when
syncache_socket() fails in_pcbconnect(), it calls tcp_discardcb() to free
resources that were just allocated by tcp_newtcpcb() and this
tcp_discardcb() would do TCPSTATES_DEC(tp->t_state).  The t_state is
TCPS_CLOSED at this point.

Make tcp_discardcb() symmetrical to tcp_newtcpcb() - not responsible for
the TCPSTATES.  Make the caller responsible for state count book keeping.

Reviewed by:            tuexen
Fixes:                  3703e1a73e0e0367c04f47f793e46495e46e647b
Differential Revision:  https://reviews.freebsd.org/D59325
DeltaFile
+0-1sys/netinet/tcp_subr.c
+1-0sys/netinet/tcp_usrreq.c
+1-12 files

FreeBSD/src 2e16d37tests/sys/netinet udp_bindings.c

tests/netinet: test case for a jail with 2 addresses

Check that wildcard bind(2) doesn't yet select a local address, and later
connect(2) succeeds.
DeltaFile
+31-0tests/sys/netinet/udp_bindings.c
+31-01 files

FreeBSD/src 08cf959sys/netinet in_pcb.c

inpcb: use new local address in in_pcbconnect()

when collecting necessary locks for the operation.  The IPv6 version
is already correct.

Submitted by:   Nick Price <nick spun.io>
Fixes:          1dda8ba77a20d983774a3bf0e94c51c93f1d8758
DeltaFile
+1-1sys/netinet/in_pcb.c
+1-11 files

FreeBSD/src 153446esys/compat/linuxkpi/common/include/linux mm.h

linuxkpi: Add `split_page()`

This function is supposed to split large pages into an array of
`PAGE_SIZE`-sized pages, with correct refcounting. This is apparently
used to allow some drivers to free a part of a large page only.

I don't think we use large pages in linuxkpi. Therefore, this new
function is curently a no-op.

The DRM drivers TTM memory manager started to use it in Linux 6.15.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58762
DeltaFile
+6-0sys/compat/linuxkpi/common/include/linux/mm.h
+6-01 files

FreeBSD/src be6e357sys/compat/linuxkpi/common/src linux_compat.c

linuxkpi: Update `struct vm_area_struct` when an existing mapping is extended

With Mesa 26 and DRM drivers in Linux 6.13, userspace will try to extend
an existing mmap, at last push the end address further.

Before this change, the mapping was not updated, but userspace would try
to access a page after the initial end address, leading to a panic
triggered by the following assertion in `vm_fault_populate()`:

    MPASS(fs->first_pindex <= pager_last);

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58195
DeltaFile
+13-0sys/compat/linuxkpi/common/src/linux_compat.c
+13-01 files

FreeBSD/src fbc89a8sys/compat/linuxkpi/common/include/linux kthread.h

linuxkpi: Add `kthread_run_worker()`

On Linux, `kthread_run_worker()` differs from `kthread_create_worker()`
by waking up the task after creating it with `kthread_create_worker()`.

On FreeBSD, we already execute it and wait for it, so probably no need
to do anything further. Therefore, `kthread_run_worker()` is an alias to
`kthread_create_worker()`.

The DRM drivers generic code started to replace
`kthread_create_worker()` by `kthread_run_worker()` as is in Linux 6.14.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57701
DeltaFile
+11-0sys/compat/linuxkpi/common/include/linux/kthread.h
+11-01 files

FreeBSD/src 33ba607sys/compat/linuxkpi/common/include/linux kobject.h

linuxkpi: Alias `sd` field of `struct kobject`

On Linux, a `struct kernfs_node *` pointer, representing a directory in
sysfs, is kept in the `sd` struct field.

We don't have that on FreeBSD because we use sysctls instead. Let's
alias the sysctl OID pointer to `sd` using an union.

This pointer is checked by the DRM drivers using:
    if (var->kobj.sd) {
        ...
    }

The amdgpu DRM driver started to use these checks in Linux 6.13.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57586
DeltaFile
+16-1sys/compat/linuxkpi/common/include/linux/kobject.h
+16-11 files

FreeBSD/src 3732127sys/amd64/amd64 pmap.c, sys/arm64/arm64 pmap.c

amd64/arm64 pmap: consistently clear PGA_WRITEABLE

We don't consistently clear PGA_WRITEABLE on fictitious, managed pages.
Some functions do, e.g., pmap_remove_all(), but several do not.  At
worst, this is just a pessimization, but there is no good reason to be
inconsistent.  Clear PGA_WRITEABLE in those that previously did not by
introducing (and using) the helper function pmap_page_is_mapped_locked()
that implements the correct test.

Reviewed by:    kib, markj
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D59466
DeltaFile
+28-36sys/arm64/arm64/pmap.c
+25-28sys/amd64/amd64/pmap.c
+53-642 files

FreeBSD/src 4e45f4csys/kern subr_bufring.c

buf_ring: tiny style(9) fixup
DeltaFile
+2-3sys/kern/subr_bufring.c
+2-31 files

FreeBSD/src 9df7eedsys/kern kern_rangelock.c

rangelock: Fix format strings for 32-bit kernels

Reported by:    Jenkins
Fixes:          f1f58bdf7b5f ("acpi_pci: Honor device proximity for DMA tags")

(cherry picked from commit c869a36fc98a2ac1df5127e34ba7f9bffa0a5ce7)
DeltaFile
+4-4sys/kern/kern_rangelock.c
+4-41 files