FreeBSD/src f9ce33bsys/dev/ixgbe ixgbe_x550.c ixgbe_type.h

ixgbe: Add 10GBase-BX BiDi SFP+ module support

10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber.  Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.

When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence.  Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.

MFC after:      2 weeks
Relnotes:       yes
DeltaFile
+56-5sys/dev/ixgbe/ixgbe_phy.c
+10-0sys/dev/ixgbe/if_ix.c
+7-0sys/dev/ixgbe/ixgbe_82599.c
+3-0sys/dev/ixgbe/ixgbe_type.h
+3-0sys/dev/ixgbe/ixgbe_phy.h
+2-0sys/dev/ixgbe/ixgbe_x550.c
+81-56 files

FreeBSD/src 4220b52sys/net if_media.h

net: Add ifmedia support for 10GBase-BX BiDi

10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber.  The optics must be paired so that
the transmit and receive wavelengths cross over.

MFC after:      2 weeks
DeltaFile
+3-0sys/net/if_media.h
+3-01 files

FreeBSD/src be3e106sys/dev/ixgbe ixgbe_common.c

ixgbe: Validate EEPROM checksum section bounds

The generic checksum walker trusts NVM section pointers and lengths and
iterates with a 16-bit index.  A corrupt section that crosses the end of
the EEPROM can wrap the index and leave the driver in an effectively
unbounded read loop during attach.

Validate each non-empty section against the discovered EEPROM word size
before reading it, and use widened arithmetic for the inclusive end and
iterator.

MFC after:      2 weeks
DeltaFile
+13-3sys/dev/ixgbe/ixgbe_common.c
+13-31 files

FreeBSD/src 660099csys/dev/ixgbe if_ix.c

ixgbe: Restore missed packet accounting

missed_rx and total_missed_rx are never populated.  As a result, the
GPRC erratum workaround does not remove missed packets and iqdrops
always remains zero.  The rx_missed_packets sysctl and input-error total
also expose only MPC bank zero.

Read and accumulate all eight MPC banks.  Use the interval total to
correct GPRC and the cumulative total for iqdrops, input errors, and the
aggregate sysctl.  This matches DPDK's coverage of the hardware banks.

MFC after:      2 weeks
DeltaFile
+10-4sys/dev/ixgbe/if_ix.c
+10-41 files

FreeBSD/src 877f0eesys/dev/ixgbe if_ix.c if_sriov.c

ixgbe: Preserve VF jumbo frame size across PF resets

sc->max_frame_size represents the largest frame requested by the PF or
an active VF.  The MTU callback replaces it with the PF frame size, so
a subsequent reinitialization can program MHADD below an active VF's
jumbo-frame request.

Recompute the aggregate before hardware initialization and use it when
programming MHADD.  Recompute after each VF LPE request as well, so a
reduced request can lower the hardware limit when no other function
needs the previous value.

MFC after:      2 weeks
DeltaFile
+4-3sys/dev/ixgbe/if_sriov.c
+5-1sys/dev/ixgbe/if_ix.c
+9-42 files

FreeBSD/src ff86fd4share/man/man4 ix.4, sys/dev/ixgbe ixgbe_type.h if_ix.c

ixgbe: Expose EEE LPI event counters

X550-family devices provide clear-on-read counters for transmit and
receive Low Power Idle events.  Accumulate each register once in the
normal statistics poll and expose the monotonic totals below the eee
sysctl node.  Document the counters together with the existing EEE
control.

Obtained from:  Intel ix 3.4.39
MFC after:      2 weeks
DeltaFile
+18-0sys/dev/ixgbe/if_ix.c
+7-1share/man/man4/ix.4
+2-0sys/dev/ixgbe/ixgbe_type.h
+27-13 files

FreeBSD/src c410551sys/dev/ixgbe if_ix.c

ixgbe: Compare flow control against requested mode

The flow-control sysctl represents the configured policy, while
current_mode is the mode negotiated with the link partner.  Comparing a
new request with current_mode can needlessly reprogram an unchanged
policy or skip a requested policy change that happens to match the
current negotiation result.

Compare with requested_mode before deciding that no update is needed.

MFC after:      2 weeks
DeltaFile
+1-1sys/dev/ixgbe/if_ix.c
+1-11 files

FreeBSD/src a884921sys/dev/ixgbe if_ixv.c

ixv: Report multigigabit link speeds

The VF link-status path can receive 2.5 and 5 Gb/s speed bits from
X550-family PFs, but media reporting has no cases for them.  The
bootverbose message also assumes every non-10-Gb/s link is 1 Gb/s.

Expose the corresponding ifmedia subtypes and derive the diagnostic
speed through the shared link-speed conversion helper.

MFC after:      2 weeks
DeltaFile
+14-4sys/dev/ixgbe/if_ixv.c
+14-41 files

FreeBSD/src dd532adinclude fts.h, lib/libc/gen fts.c fts.3

fts: reduce fd usage by storing fts_dirfd on directory entries only

Previously fts_build() called _dup(_dirfd(dirp)) for every child
entry, holding N simultaneous fds for a directory with N children.

Redefine fts_dirfd: instead of a fd for the entry's parent
directory, it is now a fd for the entry itself, set only for
directory entries. One dup per directory in fts_build() instead
of one per child.  Close fts_dirfd during the directory post-order
visit, before advancing to its sibling.

To access a file using fd-relative operations, callers should use
openat(ent->fts_parent->fts_dirfd, ent->fts_name, ...) instead of
openat(ent->fts_dirfd, ent->fts_name, ...).  The fd is valid until the
directory's post-order visit (FTS_DP).

Reported by:    Mark Johnston <markj at FreeBSD.org>
Fixes:          4bd01d6ae016 (fts: refactor to use fd-relative operations)
Sponsored by:   Google LLC (GSoC 2026)

    [2 lines not shown]
DeltaFile
+19-13lib/libc/gen/fts.3
+14-9lib/libc/gen/fts.c
+1-1include/fts.h
+34-233 files

FreeBSD/src a8c598dlib/libc/db/mpool mpool.c

mpool/mpool_get.c: Avoid clobbering 'errno' when handling 'pread' errors

POSIX.1-2024 states that the 'free' function "shall not modify errno if
ptr is a null pointer or a pointer previously returned as if by malloc()
and not yet deallocated". However this is a fairly recent addition
and non-compliant allocators might still clobber 'errno', causing
'mpool_get' to return the wrong error code. Fix this by saving
and restoring 'errno' after calling 'free'.

Sponsored by:   Klara, Inc.
Reviewed by:    obiwac
Differential Revision:  https://reviews.freebsd.org/D55463
MFC after:      1 week

(cherry picked from commit bce0c14fe19defeef4f02cfebc018e9adf979783)
DeltaFile
+4-0lib/libc/db/mpool/mpool.c
+4-01 files

FreeBSD/src 8038879lib/libc/db/hash extern.h hash_func.c

libc/db: Remove unused hash functions in hash_func.c

Prune unused code hidden behind 'notdef', bringing us in sync with
the changes in OpenBSD. Despite the `__default_hash` function pointer
having external linkage, no ABI change is expected since it was
never exported.

Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D55842
Reviewed by:    allanjude, des
MFC after:      2 weeks

(cherry picked from commit c09ccfc2665bef0d81d1db4e3713e4f2a0b5a064)
DeltaFile
+1-106lib/libc/db/hash/hash_func.c
+1-1lib/libc/db/hash/extern.h
+2-1072 files

FreeBSD/src 429e2c5usr.sbin/bhyve block_if.c

bhyve: Fix some leaks in usr.sbin/bhyve/block_if.c

Modify `blockif_open` to properly release a partially initialized
`blockif_ctxt` structure on error.

Differential Revision:  https://reviews.freebsd.org/D57887
Reviewed by:    novel, bnovkov, glebius
Tested by:      bnovkov
MFC after:      2 weeks

(cherry picked from commit 0228338fc9c6d2243fe4fd3259286d2fbc6df786)
DeltaFile
+39-9usr.sbin/bhyve/block_if.c
+39-91 files

FreeBSD/src 75d74ccbin/cat cat.c

cat: Fix a NULL pointer dereference

Check the `fdopen` return value before calling `cook_cat`.

Reviewed by:    markj, bnovkov
Differential Revision:  https://reviews.freebsd.org/D57741
MFC after:      1 week

(cherry picked from commit 9724f3f8974957d2cd15f6b796c347ca50250954)
DeltaFile
+2-1bin/cat/cat.c
+2-11 files

FreeBSD/src bb68e4ausr.sbin/bhyve bhyve.8

bhyve: Document vCPU range pinning

This change documents the recently introduced changes to -p
that allow users to specify CPU ranges instead of having to
specify each individual mapping.

While we're here, move the -p examples to the EXAMPLES section.

Reviewed by:    bcr
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57480

(cherry picked from commit 23c99b64918eddb6084ffe4347faf95f82661c47)
DeltaFile
+25-13usr.sbin/bhyve/bhyve.8
+25-131 files

FreeBSD/src f760059usr.sbin/bhyve bhyverun.c, usr.sbin/bhyve/aarch64 bhyverun_machdep.c

bhyve(8): allow cpu pinning using N-M:X-Y ranges

bhyve's -p allows to pin guest's virtual CPU vcpu to hostcpu, however
this becomes very tedious work when you have to pin more than a single
CPU.

This allows to pass a range to -p, e.g. -p 0-3:4-7 which will pin the
cpus 0:4, 1:5, 2:6, 3:7. The ranges must be equal and the CPU numbers
must be ascending.

Sponsored by: Armenian Bioinformatics Institute
Reviewed by:    corvink, markj
Tested by:      bnovkov
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D54937

(cherry picked from commit 8f6c577c9f706aea6f138fa1bec27029d4ab587d)
DeltaFile
+30-8usr.sbin/bhyve/bhyverun.c
+3-2usr.sbin/bhyve/riscv/bhyverun_machdep.c
+3-2usr.sbin/bhyve/amd64/bhyverun_machdep.c
+3-2usr.sbin/bhyve/aarch64/bhyverun_machdep.c
+39-144 files

FreeBSD/src e5d63cesys/dev/uart uart_dev_ns8250.c

uart: Add support for the Intel XScale controller

The ns8250 driver avoids clearing IER bit 0x10 to account for the
split "receiver time-out interrupt enable" bit, but it never sets
it in `ier_rxbits` even though a comment in `ns8250_init` implies so.

Fix this by setting `IER_RXTMOUT` if we've matched an XScale uart.

Differential Revision:  https://reviews.freebsd.org/D57629
Reviewed by:    imp
MFC after:      2 weeks

(cherry picked from commit 1665954e508f74588108e96c30b90d1a88807faa)
DeltaFile
+7-0sys/dev/uart/uart_dev_ns8250.c
+7-01 files

FreeBSD/src 9936021sys/riscv/riscv pmap.c

riscv/pmap.c: Add an Svinval-aware variant of pmap_invalidate_range

This change introduces a variant of `pmap_invalidate_range` that uses
the fine-grained TLB invalidation instructions introduced by the
Svinval extension. These instructions allow for more efficient TLB
flushing on certain implementations. Under this new scheme,
`pmap_invalidate_range` was converted to an ifunc that selects the
appropriate variant during boot.

Event:  BSDCan 2026
Reviewed by:    markj, mhorne
Differential Revision:  https://reviews.freebsd.org/D57624
DeltaFile
+71-2sys/riscv/riscv/pmap.c
+71-21 files

FreeBSD/src 4d2f90fsys/conf kern.mk, sys/riscv/include md_var.h cpufunc.h

riscv: Add support for the Svinval extension

This change adds wrappers for the new fine-grained TLB invalidation
instructions and extends the capability detection logic to include
the Svinval extension, which is mandatory in the RVA23S64 profile.

Event:  BSDCan 2026
Differential Revision:  https://reviews.freebsd.org/D57623
Reviewed by:    mhorne, markj
DeltaFile
+28-0sys/riscv/include/cpufunc.h
+1-1sys/conf/kern.mk
+2-0sys/riscv/riscv/identcpu.c
+1-0sys/riscv/include/md_var.h
+32-14 files

FreeBSD/src 0f2e98clib/libsysdecode netlink.c

libsysdecode: verify decoder tables are sorted

Add assertions to validate decoder table ordering required by
binary search.

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+24-0lib/libsysdecode/netlink.c
+24-01 files

FreeBSD/src 11bc539lib/libsysdecode netlink.c

libsysdecode: add attribute parsing for PFNL_CMD_GETRULES

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+13-0lib/libsysdecode/netlink.c
+13-01 files

FreeBSD/src 9b9b3b1lib/libsysdecode netlink.c

libsysdecode: also verify command decoders

We already verified that the attribute parser tables were correctly
sorted. Now also verify that the command decoders are too.

While here move the assertions into a constructor so we only run them once.
DeltaFile
+20-2lib/libsysdecode/netlink.c
+20-21 files

FreeBSD/src 2ef4baalib/libsysdecode netlink.c

libsysdecode: avoid extra commas for undecoded netlink attributes

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+6-5lib/libsysdecode/netlink.c
+6-51 files

FreeBSD/src 15c0c9dlib/libsysdecode netlink.c

libsysdecode: use decoder table for PF netlink commands

Introduce a PF netlink command decoder table mapping PFNL commands to
their attribute decoder sets. This replaces the existing switch-based
dispatch and makes it easier to add support for additional PF netlink
commands.

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+46-24lib/libsysdecode/netlink.c
+46-241 files

FreeBSD/src 91aa9bflib/libsysdecode netlink.c

libsysdecode : add attribute parsing for PFNL_CMD_GET_LIMIT

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+10-0lib/libsysdecode/netlink.c
+10-01 files

FreeBSD/src 1d926belib/libsysdecode netlink.c

libsysdecode : add attribute parsing for PFNL_CMD_KILLSTATES

Signed-off-by:  Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
DeltaFile
+79-3lib/libsysdecode/netlink.c
+79-31 files

FreeBSD/src 0048dfdsys/dev/ixl ixl_pf.h ixl_pf_iflib.c

ixl: Quiesce VF DMA before a PF reset

A PF reset has a warning interval before the hardware reset begins.
Cooperative VF drivers respond to the reset event by stopping and
releasing their receive buffers, but notifying VFs did not stop the
hardware queues.  An active VF could therefore DMA through its old
rings into freed mbuf clusters during the warning interval.

Put every enabled VF in reset, drain its PCIe transactions, disable its
queues, wait for receive queue shutdown, and drain transactions again
before tearing down the PF HMC and AdminQ.

Hold VFs in reset again while rebuilding the firmware topology.  Release
VF reset before programming the replacement VSI and queue mappings,
since VF reset clears those registers, and publish VFACTIVE only after
reconstruction succeeds.  Leave a VF held in reset if rebuilding it
fails.

Fixes:          983e628a0c47 ("ixl: Rebuild VF resources after a PF reset")
MFC after:      2 weeks
DeltaFile
+122-0sys/dev/ixl/ixl_pf_iov.c
+13-3sys/dev/ixl/ixl_pf_iflib.c
+1-0sys/dev/ixl/ixl_pf.h
+136-33 files

FreeBSD/src 02fbb1csys/dev/iavf if_iavf_iflib.c

iavf: Resume AdminQ processing after PF reset

A PF reset indication leaves IAVF_STATE_RESET_PENDING set while the
VF recreates its AdminQ and negotiates new resources.  The ordinary
AdminQ task refuses to consume messages while that state is set.
Consequently, the first DISABLE_QUEUES reply after successful mailbox
rediscovery remains in the receive queue and initialization times out.
Later retries and manual interface restarts repeat the same cycle.

Clear the stale reset indication once VERSION and GET_VF_RESOURCES have
succeeded, before enabling interrupts and resuming normal virtchnl
requests.

MFC after:      2 weeks
DeltaFile
+8-0sys/dev/iavf/if_iavf_iflib.c
+8-01 files

FreeBSD/src 5132646src/ap ieee802_11.c, src/common proximity_ranging.c qca-vendor.h

wpa: Update to 2.12

Fixes and new features include:

hostapd:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
  - more complete support
  - fix message validation issues that could enable DoS attacks
  - fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
  a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
  - changing SAE password identifiers
  - EPPKE

    [46 lines not shown]
DeltaFile
+6,124-33src/common/qca-vendor.h
+5,003-0wpa_supplicant/nan_supplicant.c
+3,381-671src/drivers/driver_nl80211.c
+3,106-664src/ap/ieee802_11.c
+3,677-0src/nan/nan.c
+2,707-0src/common/proximity_ranging.c
+23,998-1,368336 files not shown
+89,809-24,648342 files

FreeBSD/src a841961sys/net if_ovpn.c

if_ovpn: free crp, mbuf, and release refcount on crypto_dispatch() failure

When crypto_dispatch() or crypto_dispatch_async() returns non-zero,
the registered callback is never invoked. In both ovpn_transmit_to_peer()
and ovpn_udp_input(), if_ovpn.c did not free the cryptop request, release
the peer/sc reference count, or free the mbuf on dispatch failure.

This results in three simultaneous leaks per failed dispatch:
- crp allocated via crypto_getreq() is never freed
- peer->refcount (encrypt) or sc->refcount (decrypt) incremented but
  never decremented
- mbuf passed to crypto_use_mbuf() is never freed

The leaks are reachable under memory pressure when the OCF scheduler
returns ENOMEM from crypto_dispatch(). The registered callbacks
(ovpn_encrypt_tx_cb, ovpn_decrypt_rx_cb) correctly handle crp_etype
for crypto operation failures; this fix addresses the separate
dispatch-level failure path where no callback is invoked.


    [4 lines not shown]
DeltaFile
+6-0sys/net/if_ovpn.c
+6-01 files

FreeBSD/src 46241b7sys/dev/iavf if_iavf_iflib.c

iavf: Do not publish link-up while stopped

A PF link event remains cached while a VF is administratively down.
Media status queries called iavf_update_link_status() and published
that cached state as link-up, while the stopped admin path immediately
published link-down.  Consumers reacting to link events could turn
this into an unbounded notification loop and prevent interface detach
from draining its link-state task.

Keep the cached PF state, but only publish link-up after iflib has
marked the VF running.  A subsequent admin pass publishes the cached
state after a successful initialization.

MFC after:      2 weeks
DeltaFile
+10-0sys/dev/iavf/if_iavf_iflib.c
+10-01 files