FreeBSD/src 6757391 — sys/security/audit audit_syscalls.c, sys/sys syscallsubr.h

sys/security/audit: add kern_ implementations

Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
PR:             https://github.com/freebsd/freebsd-src/pull/2284
DeltaFile
+107-50sys/security/audit/audit_syscalls.c
+11-0sys/sys/syscallsubr.h
+118-502 files

FreeBSD/src 57bc1e1 — sys/amd64/amd64 machdep.c

amd64: make hw.splitlock_force adjustable at runtime

The setting is only read on exec(2), so it can be safely modified.
This is useful to adapt the system to newly discovered buggy programs
without reboot.

Note that that running processes keep their mode until they exec again.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+22-3sys/amd64/amd64/machdep.c
+22-31 files

FreeBSD/src feab010 — lib/libfetch common.c

libfetch: Use monotonic clock for timeouts

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D61225
DeltaFile
+38-48lib/libfetch/common.c
+38-481 files

FreeBSD/src 6ccf743 — lib/msun/src s_nexttowardf.c s_nexttoward.c

msun: fix behaviour of nextafter*() and nexttoward*() for MAX value

For an edge case at an extreme, e.g., nextafter(-DBL_MAX,-INFINITY)
do not return x+x.  Instead, evaluate x+x and assign it to a volatile
to raise an exception, and then fall through to return the correct
result in current rounding mode.

PR:             299389
MFC after:      6 days (for inclusion into releng/15.2)

(cherry picked from commit 1fb5d8265bc4bbbf1f5bc79cc1d2a7f280b446b2)
DeltaFile
+1-1lib/msun/src/s_nexttowardf.c
+1-1lib/msun/src/s_nexttoward.c
+1-1lib/msun/src/s_nextafterl.c
+1-1lib/msun/src/s_nextafterf.c
+1-1lib/msun/src/s_nextafter.c
+5-55 files

FreeBSD/src 42f9265 — lib/msun/src s_nexttowardf.c s_nexttoward.c

msun: fix behaviour of nextafter*() and nexttoward*() for MAX value

For an edge case at an extreme, e.g., nextafter(-DBL_MAX,-INFINITY)
do not return x+x.  Instead, evaluate x+x and assign it to a volatile
to raise an exception, and then fall through to return the correct
result in current rounding mode.

PR:             299389
MFC after:      6 days (for inclusion into releng/15.2)

(cherry picked from commit 1fb5d8265bc4bbbf1f5bc79cc1d2a7f280b446b2)
DeltaFile
+1-1lib/msun/src/s_nexttowardf.c
+1-1lib/msun/src/s_nexttoward.c
+1-1lib/msun/src/s_nextafterl.c
+1-1lib/msun/src/s_nextafterf.c
+1-1lib/msun/src/s_nextafter.c
+5-55 files

FreeBSD/src e6fc176 — sys/dev/nvme nvme_private.h nvme_pci.c

nvme: drop the S3X single-outstanding-I/O quirk

The quirk's 8KB transfer clamp exposed raw character-device I/O to
the oversized-mapping stall fixed earlier, and its single tracker
turned a stranded request into a complete I/O stall. Without it an
S3X controller runs 128 trackers at its MDTS-derived transfer size
with no retries, failures, or timeouts, at about seven times the
serialized throughput.

Reviewed by:    imp, adrian, ngie
Approved by:    ngie (co-mentor)
Differential Revision:  https://reviews.freebsd.org/D59156
DeltaFile
+0-4sys/dev/nvme/nvme_ctrlr.c
+1-2sys/dev/nvme/nvme_pci.c
+0-1sys/dev/nvme/nvme_private.h
+1-73 files

FreeBSD/src 764761d — share/man/man4 nvme.4, sys/dev/nvme nvme_private.h nvme_pci.c

nvme: program the arbitration burst from Identify RAB

The controller's Recommended Arbitration Burst was ignored; the
specification advises matching the Arbitration feature's burst to it
even under plain round robin. Some controllers report unusable
values: programming the Apple S3X with its reported RAB wedged
sustained I/O, so quirked controllers keep their default
configuration. The hw.nvme.arb_burst tunable overrides the
recommendation.

Reviewed by:    imp
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59155
DeltaFile
+38-0sys/dev/nvme/nvme_ctrlr.c
+11-0sys/dev/nvme/nvme.h
+8-1share/man/man4/nvme.4
+9-0sys/dev/nvme/nvme_ctrlr_cmd.c
+3-2sys/dev/nvme/nvme_pci.c
+3-0sys/dev/nvme/nvme_private.h
+72-36 files

FreeBSD/src 66d078c — sys/netlink netlink_sysevent.c

netlink: Pre-register the missing devctl event systems

devctl_notify() can be called with a mutex held. If the event system is
not listed in devctl_systems[], sysevent_get_group() calls
sysevent_new_group(), which calls strdup() with M_WAITOK, and we may end
up sleeping while holding a non-sleepable mutex.

Add the missing systems.

While here, remove the nonexistent KERNEL system.

PR:             299272
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D61161
DeltaFile
+3-1sys/netlink/netlink_sysevent.c
+3-11 files

FreeBSD/src 1dd8d2d — sys/dev/bnxt/bnxt_en bnxt_ktls.h if_bnxt.c

if_bnxt: skip HW kTLS on old firmware and add a tunable to disable it

Older Thor2 firmware serves key context allocation requests very
slowly, about a second each. The driver allocates key contexts in
batches of 128, so setting up 500k sessions takes roughly 3900
requests and driver load appears to hang.

Enable hardware kTLS only when the firmware's HWRM interface version
is 1.10.3.99 or newer. Keep the full four-part version in
hwrm_spec_code_ext for the comparison.

Also add a disable_hw_ktls loader tunable that turns hardware kTLS off
for a device without unloading kTLS support, which helps isolate kTLS
problems in the field.

Reviewed by:    gallatin
Sponsored by:   Broadcom Inc
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D60977

    [2 lines not shown]
DeltaFile
+14-0sys/dev/bnxt/bnxt_en/bnxt_ktls.c
+6-0sys/dev/bnxt/bnxt_en/bnxt_sysctl.c
+6-0sys/dev/bnxt/bnxt_en/bnxt.h
+2-1sys/dev/bnxt/bnxt_en/if_bnxt.c
+3-0sys/dev/bnxt/bnxt_en/bnxt_hwrm.c
+2-0sys/dev/bnxt/bnxt_en/bnxt_ktls.h
+33-16 files

FreeBSD/src 74356e5 — sys/dev/bnxt/bnxt_en bnxt.h bnxt_hwrm.c

if_bnxt: size MRAV from the AV split entry for backing store V2

On RoCE-capable Thor2, attach fails with
HWRM_FUNC_BACKING_STORE_CFG_V2 returning INVALID_PARAMS, as MRAV is
sized the pre-V2 way and the firmware's AV split value is sent as is.

Size MRAV from the AV split entry, and move the legacy entry-count
packing into bnxt_hwrm_func_backing_store_cfg().

Fixes: d5ce906da7c5 ("bnxt_en: Add backing store V2 support")
Reviewed by:    gallatin
Sponsored by:   Broadcom Inc
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D60976

(cherry picked from commit aca2e5fae3d9c3350b47ee3e7d00937a73dba9a9)
DeltaFile
+12-12sys/dev/bnxt/bnxt_en/if_bnxt.c
+11-1sys/dev/bnxt/bnxt_en/bnxt_hwrm.c
+2-0sys/dev/bnxt/bnxt_en/bnxt.h
+25-133 files

FreeBSD/src aa5bef3 — . myproposal.h channels.c, openbsd-compat readpassphrase.c port-uw.c

Vendor import of OpenSSH 10.6p2

Sponsored by:   The FreeBSD Foundation
DeltaFile
+13-5openbsd-compat/xcrypt.c
+13-4auth-passwd.c
+8-8openbsd-compat/port-uw.c
+5-5openbsd-compat/readpassphrase.c
+3-4channels.c
+3-2myproposal.h
+45-2810 files not shown
+60-3716 files

FreeBSD/src 27d5ac6 — contrib/expat Changes, contrib/expat/lib entities.h xmlparse.c

contrib/expat: import expat 2.10.0

Changes: https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes

Security:       CVE-2026-115506
Security:       CVE-2026-117610
Security:       CVE-2026-118370

(cherry picked from commit 765f30b9f3af67a1db9619ff18862dc74ac72674)
(cherry picked from commit a377d25bd25c0739d50c4dfe34ec2066821018d3)
DeltaFile
+731-138contrib/expat/lib/xmlparse.c
+246-0contrib/expat/tests/entities_tests.c
+180-1contrib/expat/tests/misc_tests.c
+99-0contrib/expat/lib/entities.h
+89-0contrib/expat/Changes
+48-15contrib/expat/tests/basic_tests.c
+1,393-15430 files not shown
+1,646-19736 files

FreeBSD/src b22b999 — lib/libsecureboot local.trust.mk

libsecureboot restore default trust anchors

If site.trust.mk does not set VE_SIGNATURE_LIST
initialize it based on content of VE_SIGNATURE_EXT_LIST
which is in turn initialized from TRUST_ANCHORS.

Sponsored by:   Hewlett Packard Enterprise Development LP

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D61245
DeltaFile
+10-1lib/libsecureboot/local.trust.mk
+10-11 files

FreeBSD/src 8a24244 — release/pkg_repos release-dvd.conf, sys/conf newvers.sh

15.2: create releng/15.2 branch

* Update from PRERELEASE to BETA1
* Ship quarterly packages on DVDs
* Point pkg at stable/15 kmod packages since releng/15.2 packages
  don't exist yet
* Bump __FreeBSD_version to 1502000

Approved by:    re (implicit)
DeltaFile
+1-1usr.sbin/pkg/FreeBSD.conf.quarterly-release
+1-1sys/sys/param.h
+1-1sys/conf/newvers.sh
+1-1release/pkg_repos/release-dvd.conf
+4-44 files

FreeBSD/src b036c1e — sys/conf newvers.sh, sys/sys param.h

Post-15.2-branch updates

Rename stable/15 to -STABLE

Bump __FreeBSD_version to 1502500

Approved by:    re (implicit)
DeltaFile
+1-1sys/sys/param.h
+1-1sys/conf/newvers.sh
+2-22 files

FreeBSD/src cf59649 — sys/xdr xdr_mbuf.c

xdr_mbuf.c: Add a check for the return value for xdrmbuf_getbytes()

The xdrmbuf_getlong() function failed to check for the return
value from xdrmbuf_getbytes().  This could have resulted in
a failure during NFS RPC message processing.

Reviewed by:    rmacklem
MFC after:      2 weeks
Sponsored by:   VersatusHPC
DeltaFile
+2-1sys/xdr/xdr_mbuf.c
+2-11 files

FreeBSD/src 6b27d7f — contrib/expat Changes, contrib/expat/lib entities.h xmlparse.c

contrib/expat: import expat 2.10.0

Changes: https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes

Security:       CVE-2026-115506
Security:       CVE-2026-117610
Security:       CVE-2026-118370

(cherry picked from commit 765f30b9f3af67a1db9619ff18862dc74ac72674)
(cherry picked from commit a377d25bd25c0739d50c4dfe34ec2066821018d3)
DeltaFile
+731-138contrib/expat/lib/xmlparse.c
+246-0contrib/expat/tests/entities_tests.c
+180-1contrib/expat/tests/misc_tests.c
+99-0contrib/expat/lib/entities.h
+89-0contrib/expat/Changes
+48-15contrib/expat/tests/basic_tests.c
+1,393-15430 files not shown
+1,646-19736 files

FreeBSD/src 530ece4 — sys/kern sched_shim.c

sched: Add sysctl flag CTLFLAG_TUN to loader tunable kern.sched.name

So that `sysctl -T` can report it correctly.

Reviewed by:    olce, kib
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D61178

(cherry picked from commit 5e54a402f896106ed6b402e25387ad7402b8944c)
DeltaFile
+2-1sys/kern/sched_shim.c
+2-11 files

FreeBSD/src 44eaf36 — lib/libc/locale mbrtocXX_iconv.h

libc/locale: Check EILSEQ return

_citrus_iconv_std_iconv_convert can return EILSEQ without setting
invlen. As a result, we should check EILSEQ in the return value or it
will incorrectly return -2

Reviewed by:    kevans
Fixes: e2030ca246a7 ("libc: fix c*rtomb/mbrtoc*")
MFC after:      2 days
Differential Revision: https://reviews.freebsd.org/D61151

(cherry picked from commit b138d017c70421e9d074096fcc3ac676f7e1c846)
DeltaFile
+1-1lib/libc/locale/mbrtocXX_iconv.h
+1-11 files

FreeBSD/src 12f90bb — sys/dev/virtio/random virtio_random.c

virtio_random: defer first enqueue until after DRIVER_OK

According to the virtio spec:

> The driver MUST NOT send any buffer available notifications to the
> device before setting DRIVER_OK.

DRIVER_OK isn't set until after attach completes, so defer the first
enqueue.  We haven't found any problems as a result of this to the best
of my knowledge: q35 and other devices that we *have* been used with
will apparently check when we go DRIVER_OK.

Tested with q35 virtio-random, which still works.

Reported by:    llm-postcr
Reviewed by:    kfv, markj
Fixes:  f1c5a2e3a62505 ("virtio_random: Pipeline fetching the data")
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D61228
DeltaFile
+16-2sys/dev/virtio/random/virtio_random.c
+16-21 files

FreeBSD/src 3c40506 — sbin/ggate/ggated ggated.c, sbin/ggate/ggatel ggatel.c

ggate: fix test intermittency

* ggatel: fix piped output.  Flush stdout before daemonizing, so the
  output can be read when it's in a command pipeline.

* ggated: bind the port _before_ daemonizing, so an invoking script can
  be sure that the port is bound as soon as the command returns.

* tests: allow ggatec or ggatel to automatically allocate a device
  number instead of choosing one in a racy way.

With all of these changes I can no run the tests 1000 times without
fail.  And in parallel, too.

Sponsored by:   ConnectWise
PR:             298942
Reported by:    siva
Reviewed by:    ngie
Differential Revision: https://reviews.freebsd.org/D60707

    [2 lines not shown]
DeltaFile
+17-31tests/sys/geom/class/gate/ggate_test.sh
+13-8sbin/ggate/ggated/ggated.c
+3-1sbin/ggate/ggatel/ggatel.c
+0-3tests/sys/geom/class/gate/Makefile
+33-434 files

FreeBSD/src 878084c — sys/fs/nfsserver nfs_nfsdstate.c

nfsserver: Do not increment seqid on BADSEQID

When returning NFSERR_BADSEQID, the server should not have incremented
the sequence ID, yet the call to nfsrv_checkseqid() a few lines above
does precisely that.  Instead, check for a legitimate retransmission
of the original successful request, and reject otherwise, before the
ticket is used and sequence ID incremented.

MFC after:      1 week
Fixes:          ff45b9fc1a8c ("Bjorn reported a problem...")
Sponsored by:   Klara, Inc.
Reviewed by:    rmacklem
Differential Revision:  https://reviews.freebsd.org/D61156
DeltaFile
+20-8sys/fs/nfsserver/nfs_nfsdstate.c
+20-81 files

FreeBSD/src 3ac9299 — lib/libc/gen Symbol.map timespec_getres.3, lib/libc/tests/gen Makefile timespec_getres_test.c

libc: Export timespec_getres(3) and add tests

timespec_getres() has been declared in <time.h> and built into libc,
but never listed in a symbol map.  It is therefore local to libc.so,
and dynamically linked callers fail to link.

Reviewed by:    ziaee, fuz, des
Approved by:    fuz (mentor)
Fixes:          9b5d724cad10 ("libc: Add timespec_getres(3) as per C23.")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D60799
DeltaFile
+124-0lib/libc/tests/gen/timespec_getres_test.c
+6-2lib/libc/gen/timespec_getres.3
+1-0lib/libc/tests/gen/Makefile
+1-0lib/libc/gen/Symbol.map
+132-24 files

FreeBSD/src bfe4be8 — sys/dev/tpm tpm_crb.c

tpm_crb: wait for idle and locality release after each command

transmit only requested GO_IDLE and the locality release, so a back-to-back
command could see stale state and fail with EIO.
A post-send idle timeout no longer discards a completed response.

Reviewed by:    kbowling
Approved by:    kbowling
Differential Revision:  https://ron-dev.freebsd.org/FreeBSD/src/pulls/93
DeltaFile
+32-7sys/dev/tpm/tpm_crb.c
+32-71 files

FreeBSD/src 97b359e — sys/fs/tarfs tarfs_subr.c

tarfs: Fix length calculation for file read

When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.

Reported by:    n0ps1ed
MFC after:      1 week
Reviewed by:    markj, emaste
Differential Revision:  https://reviews.freebsd.org/D60904

(cherry picked from commit 18bce6e65cdf059618ff12ace82a9f7334e1b610)
DeltaFile
+3-2sys/fs/tarfs/tarfs_subr.c
+3-21 files

FreeBSD/src 7c44749 — sys/kern vfs_vnops.c

vfs: Avoid integer overflow when faulting

In vn_io_fault1(), the read / write length can easily exceed INT_MAX.
Passing it directly to uiomove(), which expects an int, results in a
negative uio_resid, which to the caller looks like we read more than
was requested.

PR:             298159
MFC after:      1 week
Reviewed by:    olce, kib
Differential Revision:  https://reviews.freebsd.org/D59412

(cherry picked from commit b487aca48535e5f04e4913447fcbe33f1bf56c68)
DeltaFile
+9-3sys/kern/vfs_vnops.c
+9-31 files

FreeBSD/src 6418155 — sys/fs/tarfs tarfs_subr.c

tarfs: Limit file name length

When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.

Reported by:    n0ps1ed
Reported by:    Franz Bettag <franz at bett.ag>
MFC after:      1 week
Reviewed by:    markj, emaste
Differential Revision:  https://reviews.freebsd.org/D60903

(cherry picked from commit a38033234692e9dab6f3f4404adc693fccabc14a)
DeltaFile
+2-0sys/fs/tarfs/tarfs_subr.c
+2-01 files

FreeBSD/src bee1ce4 — sys/fs/tarfs tarfs_subr.c

tarfs: Limit file name length

When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.

Reported by:    n0ps1ed
Reported by:    Franz Bettag <franz at bett.ag>
MFC after:      1 week
Reviewed by:    markj, emaste
Differential Revision:  https://reviews.freebsd.org/D60903

(cherry picked from commit a38033234692e9dab6f3f4404adc693fccabc14a)
DeltaFile
+2-0sys/fs/tarfs/tarfs_subr.c
+2-01 files

FreeBSD/src 9d5a02e — sys/fs/tarfs tarfs_subr.c

tarfs: Fix length calculation for file read

When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.

Reported by:    n0ps1ed
MFC after:      1 week
Reviewed by:    markj, emaste
Differential Revision:  https://reviews.freebsd.org/D60904

(cherry picked from commit 18bce6e65cdf059618ff12ace82a9f7334e1b610)
DeltaFile
+3-2sys/fs/tarfs/tarfs_subr.c
+3-21 files

FreeBSD/src 0946632 — sys/kern vfs_vnops.c

vfs: Avoid integer overflow when faulting

In vn_io_fault1(), the read / write length can easily exceed INT_MAX.
Passing it directly to uiomove(), which expects an int, results in a
negative uio_resid, which to the caller looks like we read more than
was requested.

PR:             298159
MFC after:      1 week
Reviewed by:    olce, kib
Differential Revision:  https://reviews.freebsd.org/D59412

(cherry picked from commit b487aca48535e5f04e4913447fcbe33f1bf56c68)
DeltaFile
+9-3sys/kern/vfs_vnops.c
+9-31 files