FreeBSD/src d583f31tests/sys/kern/tty test_sti.c

tests: Fix build if TIOCSTI is not defined

Some downstream projects (e.g. ElectroBSD) have removed the TIOCSTI

We already have some components (such as mail and tcsh) that build
without TIOCSTI defined.  This is (existing portability support in those
projects.

Simplify things for downstreams by extending this approach to this
additional TIOCSTI user.

Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D50614

(cherry picked from commit 52a2b4bc5da21d7a54cb16b9450196244b59b8c0)
(cherry picked from commit b1bb3aa65cc9d720f54dba009565e0d1d0419323)
DeltaFile
+6-0tests/sys/kern/tty/test_sti.c
+6-01 files

FreeBSD/src 3e42109sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: deal with wdev list, and misc

Fill in more (lvif) wdev details and add it to the list under the wiphy
struct so that iterators at least work and find the (one) device.
This is needed for the upcoming espwl(4) driver.

misc: add WPI-SMS4 to the list of cipher suits (we won't support it but
at least print the name).

MFC after:      3 days
DeltaFile
+24-5sys/compat/linuxkpi/common/src/linux_80211.c
+24-51 files

FreeBSD/src 83e8fd6sys/net80211 ieee80211_radiotap.h

net8021!: radiotap: add another HE define

Add another HE define needed by the upcoming espwl(4).

MFC after:      3 days
DeltaFile
+1-0sys/net80211/ieee80211_radiotap.h
+1-01 files

FreeBSD/src 9b13e6csys/compat/linuxkpi/common/include/linux nl80211.h ieee80211.h, sys/compat/linuxkpi/common/include/net mac80211.h cfg80211.h

LinuxKPI: 802.11: add more defines, structures, ...

Add more defines, structures, sort struct field types, add inline
functions (partially implemented) all needed for the upcoming
espwl(4) wireless driver.

MFC after:      3 days
DeltaFile
+46-10sys/compat/linuxkpi/common/include/net/cfg80211.h
+22-5sys/compat/linuxkpi/common/include/linux/ieee80211.h
+11-1sys/compat/linuxkpi/common/include/net/mac80211.h
+6-0sys/compat/linuxkpi/common/include/linux/nl80211.h
+85-164 files

FreeBSD/src 3a1bf59lib/libsys stat.2, sys/kern uipc_shm.c

shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks

This is ABI-breaking change that could be considered as the bug fix.

Requested by:   David Timber <dxdt at dev.snart.me>
Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
Relnotes:       yes
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58942
DeltaFile
+2-6sys/kern/uipc_shm.c
+6-2lib/libsys/stat.2
+8-82 files

FreeBSD/src 805c500tools/build Makefile

tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts

37bd69d43c7 gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>.  Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS.  Both headers are self-contained; stage them alongside
stdckdint.h.

Fixes:          37bd69d43c7 ("sys: Add sys/ckdint.h")
Reviewed by:    rpaulo, markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58943
DeltaFile
+4-0tools/build/Makefile
+4-01 files

FreeBSD/src 4b1974esys/amd64/vmm x86.h x86.c

vmm: Emulate CPUID leaf 1Fh for guests

On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.

A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a94d it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher.  bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path.  x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim.  The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads.  Hosts whose maximum basic leaf is below

    [13 lines not shown]
DeltaFile
+4-1sys/amd64/vmm/x86.c
+1-0sys/amd64/vmm/x86.h
+5-12 files

FreeBSD/src 8d29d24include stdio.h limits.h, stand/libsa/geli geliboot_internal.h

libc: Restore prior C23 include guards

To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them.  This is to close off whole class of possible breakage,
rather than patching it case by case.

Reported by:    dim
Reviewed by:    dim, dteske, fuz
Approved by:    dim, dteske (mentor), fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58911
DeltaFile
+1-7stand/libsa/geli/geliboot_internal.h
+5-3include/assert.h
+4-2sys/sys/stdatomic.h
+4-2include/stdio.h
+4-2include/limits.h
+1-1sys/sys/syslimits.h
+19-175 files not shown
+24-2211 files

FreeBSD/src 8109a5ccontrib/netbsd-tests/lib/libc/c063 t_fchmodat.c t_mkfifoat.c

contrib/netbsd-tests: lib/libc/c063: sync with NetBSD

This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
  with ATF 0.22+ [1].
- Brings in some new test coverage.

Obtained from:  NetBSD (date tag: `20260818UTC`)
MFC after:      2 weeks
1. https://github.com/freebsd/atf/pull/72
DeltaFile
+89-59contrib/netbsd-tests/lib/libc/c063/t_utimensat.c
+69-4contrib/netbsd-tests/lib/libc/c063/t_faccessat.c
+29-2contrib/netbsd-tests/lib/libc/c063/t_mkfifoat.c
+11-6contrib/netbsd-tests/lib/libc/c063/t_fchmodat.c
+198-714 files

FreeBSD/src b826ca0lib/libexpat libbsdxml.3

libexpat: update AUTHORS section of libbsdxml.3

The eXpat project has changed maintainers since this section was written
in 2002.  Update it to reflect reality.

Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D58835

(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
DeltaFile
+8-5lib/libexpat/libbsdxml.3
+8-51 files

FreeBSD/src 465c0e4contrib/expat Changes, contrib/expat/doc reference.html

contrib/expat: import expat 2.8.3

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522

(cherry picked from commit 207d96dabfec14d7b3699747abb539ab3c1118ab)
DeltaFile
+77-20contrib/expat/Changes
+49-25contrib/expat/lib/xmlparse.c
+70-1contrib/expat/tests/misc_tests.c
+32-1contrib/expat/tests/basic_tests.c
+29-1contrib/expat/doc/reference.html
+5-12contrib/expat/lib/internal.h
+262-6082 files not shown
+455-8288 files

FreeBSD/src 99fda13sys/net80211 ieee80211_ioctl.h ieee80211_ioctl.c

net80211: migrate the ioctl API to a 128 bit specific API + use key API

* Begin migrating the ioctl code to use the key management APIs.
  Not all of it has been migrated (notably the WEP API hasn't.)

* Take special care to copy the TKIP MIC in and out correctly.

* Note that some of the defines used as sizes are actually the ioctl
  sizes, they'll need to be fixed before I push this into a review.

* Document this current API as a specific 128 bit key + 128 bit
  TKIP MIC API.

The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.

Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP

    [6 lines not shown]
DeltaFile
+129-22sys/net80211/ieee80211_ioctl.c
+6-2sys/net80211/ieee80211_ioctl.h
+135-242 files

FreeBSD/src db4d6f7sys/net80211 ieee80211_crypto.h

net80211: add key get/set methods

Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.

Differential Revision:  https://reviews.freebsd.org/D58705
DeltaFile
+147-0sys/net80211/ieee80211_crypto.h
+147-01 files

FreeBSD/src 874035csys/net80211 ieee80211_crypto.c

net80211: fix WEP transmit

This was broken in 2022 with a security fix (61605e0ae5d8f) which
disallowed defaulting to the default TX key if there's no unicast
key.  Unfortunately this path was also used by WEP transmit.

To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.

Fixes: 61605e0ae5d8f

Locally tested:

* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured

Differential Revision:  https://reviews.freebsd.org/D58854
DeltaFile
+18-0sys/net80211/ieee80211_crypto.c
+18-01 files

FreeBSD/src 8ddc54fsys/dev/intel spi_pci.c

intelspi: add Gemini Lake SPI controller PCI IDs

Add Gemini Lake LPSS SPI controller PCI IDs (0x31c2, 0x31c4, 0x31c6)
to intelspi_pci_devices[].

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58868
DeltaFile
+3-0sys/dev/intel/spi_pci.c
+3-01 files

FreeBSD/src 051cfdalib/libexpat libbsdxml.3

libexpat: update AUTHORS section of libbsdxml.3

The eXpat project has changed maintainers since this section was written
in 2002.  Update it to reflect reality.

Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D58835

(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
DeltaFile
+8-5lib/libexpat/libbsdxml.3
+8-51 files

FreeBSD/src 330b8d6contrib/expat Changes, contrib/expat/doc reference.html

contrib/expat: import expat 2.8.3

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522

(cherry picked from commit 207d96dabfec14d7b3699747abb539ab3c1118ab)
DeltaFile
+77-20contrib/expat/Changes
+49-25contrib/expat/lib/xmlparse.c
+70-1contrib/expat/tests/misc_tests.c
+32-1contrib/expat/tests/basic_tests.c
+29-1contrib/expat/doc/reference.html
+5-12contrib/expat/lib/internal.h
+262-6082 files not shown
+455-8288 files

FreeBSD/src c90c46esys/compat/linux linux_ioctl.h linux_ioctl.c

linux: add dma-buf and sync_file ioctl handlers

drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback().  Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.

Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)
DeltaFile
+38-0sys/compat/linux/linux_ioctl.c
+20-0sys/compat/linux/linux_ioctl.h
+58-02 files

FreeBSD/src 95c04b2sys/arm/broadcom/bcm2835 bcm2835_audio.c

bcm2835_audio: Comment out vchi_service_release()

bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.

In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.

vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.

PR:             297187
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58921
DeltaFile
+1-1sys/arm/broadcom/bcm2835/bcm2835_audio.c
+1-11 files

FreeBSD/src 7cc6a5dcontrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
(cherry picked from commit 86aea5b4db379327f02ca547575105788bfbe807)

Approved by:    re (cperciva)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files

FreeBSD/src 3a1396acontrib/less option.c cmdbuf.c

MFV less v691

Relnotes:       yes

(cherry picked from commit dafba19e42e78cd3d7c9264ece49ddd3d7d70da5)

MFV: less v692.

(cherry picked from commit e2abec625bf07c054f7ac2df2402d6c454113df8)
(cherry picked from commit 6330c2f5fbbf1320d768fa55f267c114654d729b)

Approved by:    re (cperciva)
DeltaFile
+1,017-476contrib/less/less.nro
+374-153contrib/less/screen.c
+245-144contrib/less/lesskey.nro
+107-51contrib/less/mark.c
+70-68contrib/less/option.c
+81-57contrib/less/cmdbuf.c
+1,894-94958 files not shown
+2,855-1,45464 files

FreeBSD/src 0256ea4sbin/nvmecontrol power.c, sbin/nvmecontrol/modules/wdc wdc.c

nvmecontrol: Add SPDX-License-Identifier tags

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55275

(cherry picked from commit f8517c21d57f1db005c0d15e14d16252e8e4bfd0)
DeltaFile
+2-0sbin/nvmecontrol/power.c
+2-0sbin/nvmecontrol/modules/wdc/wdc.c
+4-02 files

FreeBSD/src 228b410usr.sbin/bhyve/amd64 atkbdc.h

bhyve: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation

(cherry picked from commit 499d0f04f55e52327d624d27ead3a0d16e3b465a)
DeltaFile
+2-0usr.sbin/bhyve/amd64/atkbdc.h
+2-01 files

FreeBSD/src ef55753sbin/decryptcore decryptcore.c

decryptcore: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55270

(cherry picked from commit 299d3e944a15cbffc8ed16a49869e1eaec1fb493)
DeltaFile
+2-0sbin/decryptcore/decryptcore.c
+2-01 files

FreeBSD/src cd9810fsys/dev/sound/pci csavar.h csa.c, sys/dev/sound/pcm buffer.c dsp.c

sound: Use unsigned long instead of legacy u_long

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

(cherry picked from commit afe56ee24679d6584acf02dd17f6ed52c052abe7)
DeltaFile
+22-21sys/dev/sound/pci/csapcm.c
+12-10sys/dev/sound/pci/csa.c
+6-6sys/dev/sound/pci/csavar.h
+3-3sys/dev/sound/pcm/dsp.c
+3-2sys/dev/sound/usb/uaudio.c
+3-2sys/dev/sound/pcm/buffer.c
+49-446 files not shown
+61-5412 files

FreeBSD/src 644990fshare/examples/jails jng

New version of jng (9.0)

Changes for jng 2.0 -> 9.0 include:

+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
  mapping table stays small (first hook is uplink; unknown unicast
  goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
  NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
  cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026

See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.

MFC after:      1 week
Reviewed by:    kfv, jlduran
Differential Revision:  https://reviews.freebsd.org/D58903
DeltaFile
+230-113share/examples/jails/jng
+230-1131 files

FreeBSD/src b385e49. INSTALL.md, doc atf-test-case.7

Import files missed in previous imports

Fixes:  0c9bf043 ("vendor/atf: import atf-0.24-rc1")
DeltaFile
+1,070-0m4/ac_cxx_compile_stdcxx.m4
+328-0doc/atf-test-case.7
+219-0INSTALL.md
+1,617-03 files

FreeBSD/src 5e0e6a9sys/kern uipc_usrreq.c

unix: wrap comments to fit in 80 char line

Fixes:  6563dcb6b1f57e51db63854f3774b52e672232ed
DeltaFile
+4-4sys/kern/uipc_usrreq.c
+4-41 files

FreeBSD/src b567434stand/efi/boot1 zfs_module.c, stand/libsa/zfs zfs.c zfsimpl.c

stand: set st_dev/st_ino in the loader's ZFS stat for veriexec

The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.

Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:

- st_dev = the dataset's ds_fsid_guid (as the kernel does via
  dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
  zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
  through struct file (the loader's equivalent of the kernel's z_id).

dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly

    [14 lines not shown]
DeltaFile
+48-6stand/libsa/zfs/zfsimpl.c
+5-3stand/libsa/zfs/zfs.c
+3-2stand/efi/boot1/zfs_module.c
+56-113 files

FreeBSD/src b39457bsys/dev/virtio/p9fs virtio_p9fs.c

virtio_p9fs: Disallow detach if a session is in progress

PR:             295453
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57500
DeltaFile
+4-0sys/dev/virtio/p9fs/virtio_p9fs.c
+4-01 files