FreeBSD/src da04cf0 — usr.bin/mkimg mkimg.c

mkimg: Ignore redundant %align values

Partitions are trivially aligned to sector boundaries, so asking e.g.
for a partition to be aligned to a 64-byte boundary is pointless but
harmless.  Treat it as such, with a warning (in case the request was
a mistake, e.g. requesting 1-byte instead of 1M-byte alignment) rather
than as an error.

Reviewed by:    markj
Suggested by:   markj
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60819
DeltaFile
+9-1usr.bin/mkimg/mkimg.c
+9-11 files

FreeBSD/src 5774911 — release/tools ec2.conf

EC2: Align partitions to 1 MB boundaries

Reviewed by:    jlduran, imp
MFC after:      2 months
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60455
DeltaFile
+4-0release/tools/ec2.conf
+4-01 files

FreeBSD/src f46269a — release/tools vmimage.subr

vmimage.subr: Support partition alignment

If VM_PARTALIGN is set, pass %${VM_PARTALIGN} to mkimg in the
specification of swap, config, root, and ESP partitions.  (Boot
partitions are not aligned, both because they're small and in
case firmware makes assumptions about their locations.)

Reviewed by:    lwhsu, imp
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60454
DeltaFile
+11-7release/tools/vmimage.subr
+11-71 files

FreeBSD/src 1485ee7 — usr.bin/mkimg mkimg.c

mkimg: Remove duplicate variable assignment

Fixes:  459a61fd2d0a ("Add the ability to specify absolute and relative offsets to size partitions.")
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60452
DeltaFile
+0-1usr.bin/mkimg/mkimg.c
+0-11 files

FreeBSD/src 0f787e8 — . Makefile.inc1, sys/sys param.h

__FreeBSD_version: Bump for mkimg %align feature

MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60453
DeltaFile
+2-3Makefile.inc1
+1-1sys/sys/param.h
+3-42 files

FreeBSD/src b063ea6 — usr.bin/mkimg mkimg.1

mkimg.1: Document new %align mechanism

Reviewed by:    imp (earlier version)
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60451
DeltaFile
+21-3usr.bin/mkimg/mkimg.1
+21-31 files

FreeBSD/src 9bc2baa — sys/dev/mii smscphy.c miidevs

mii: Fix SMSC name

The LAN8700 / LAN8710 PHYs were Standard Microsystems Corporation parts,
which early on used SMC as an abbreviation but they were using SMSC when
they were exclusively an IC maker (as opposed to full add-in NICs).

SMSC was acquired by Microchip in 2012.  I kept the pre-acquisition
name, as NetBSD (from where we obtained miidevs) uses SMSC.

Reviewed by:    adrian
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56819

(cherry picked from commit 89c883c09ab5e0fdca7ac5dfe74fcc46b7669eb5)
(cherry picked from commit f2f67df8c92b51d0bff9c226755cd31c8d685573)
DeltaFile
+4-4sys/dev/mii/miidevs
+2-2sys/dev/mii/smscphy.c
+6-62 files

FreeBSD/src 8a6a769 — sys/dev/sound/pcm mixer.c

sound: Use GID_WHEEL/0666 instead of GID_AUDIO/0660 to create the mixer cdev

This change got accidentally carried over after an MFC, because in all
audio devices are now created with GID_AUDIO/0660 in -CURRENT.

Fixes:          2b61245f5a16 ("sound: Simplify how snd_mixer is fetched and how the cdev is created")
PR:             299683
Sponsored by:   The FreeBSD Foundation
DeltaFile
+2-2sys/dev/sound/pcm/mixer.c
+2-21 files

FreeBSD/src 729883c — usr.bin/mkimg mkimg.c

mkimg: Add per-partition alignment

This adds a "%align" field to partition specifications, resulting in
the start of a partition being shifted to the next aligned position.
When both :offset and %align are used, a relative offset is treated as
a minimum value, while an unaligned absolute offset is an error.

Reviewed by:    imp (earlier version)
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60450
DeltaFile
+50-12usr.bin/mkimg/mkimg.c
+50-121 files

FreeBSD/src e7f84fe — usr.bin/mkimg mkimg.c

mkimg: Don't ignore invalid partition offsets

When handling PART_KIND_FILE, the "error" variable is set to reflect
any errors in parsing the specified offset; but that value is then
overwritten by the return value of image_copyin.

Error out immediately instead.  Note that it is not necessary to change
the code in PART_KIND_SIZE which parses the size, since in that case we
do not overwrite the value in "error".

Fixes:          8f3c71c85e5f ("mkimg: Add support for offset if the source is an image")
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60422
DeltaFile
+1-1usr.bin/mkimg/mkimg.c
+1-11 files

FreeBSD/src 38407c4 — usr.bin/mkimg vmdk.c

mkimg: Use reallocf

Reviewed by:    ngie
Suggested by:   ngie
Improves:       1a0523197c5c ("mkimg: Check for realloc failure")
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D60419
DeltaFile
+2-5usr.bin/mkimg/vmdk.c
+2-51 files

FreeBSD/src c6d7a24 — contrib/unbound/services mesh.c outside_network.c, contrib/unbound/util/data dname.c msgparse.c

unbound: Update to 1.26.2

Release notes at
    https://community.nlnetlabs.nl/t/unbound-1-26-2-released

Merge commit 'ce3304d97ba4861eabac759e538426a568aef0a5'

Security:       CVE-2026-35501
Security:       CVE-2026-50106
Security:       CVE-2026-96405
Security:       CVE-2026-97206
Security:       CVE-2026-109125
DeltaFile
+40-21contrib/unbound/util/data/msgparse.c
+35-21contrib/unbound/services/authzone.c
+55-0contrib/unbound/util/data/dname.c
+45-0contrib/unbound/services/outside_network.c
+30-10contrib/unbound/services/mesh.c
+16-12contrib/unbound/validator/validator.c
+221-6424 files not shown
+317-11630 files

FreeBSD/src ce3304d — services outside_network.c authzone.c, testcode unitdname.c

import unbound 1.26.2
DeltaFile
+40-21util/data/msgparse.c
+35-21services/authzone.c
+55-0util/data/dname.c
+50-0testcode/unitdname.c
+45-0services/outside_network.c
+35-7testdata/val_anchor_nx_nosig.rpl
+260-4918 files not shown
+388-10524 files

FreeBSD/src 3d5a0b7 — sys/sys elf_common.h

sys/elf_common.h: Add the gABI spelling for a dynamic tag value.

(cherry picked from commit b5f564fc5cdb56d6a24e31ca077c5f1f088a597d)
DeltaFile
+4-1sys/sys/elf_common.h
+4-11 files

FreeBSD/src be3ba03 — sys/amd64/include ieeefp.h, sys/arm/include ieeefp.h

machine/ieeefp.h: include <sys/cdefs.h>

The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>.  Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.

Suggested by:   jhb
Reviewed by:    jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59659

(cherry picked from commit 9d50245a0f1333e10cc1c4dda16878cd79a7c42b)
(cherry picked from commit 252500da3a45a89d91c276db88f9669314cc2dfa)
DeltaFile
+2-0sys/riscv/include/ieeefp.h
+2-0sys/powerpc/include/ieeefp.h
+2-0sys/arm64/include/ieeefp.h
+2-0sys/arm/include/ieeefp.h
+1-0sys/amd64/include/ieeefp.h
+9-05 files

FreeBSD/src 252500d — sys/amd64/include ieeefp.h, sys/arm/include ieeefp.h

machine/ieeefp.h: include <sys/cdefs.h>

The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>.  Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.

Suggested by:   jhb
Reviewed by:    jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59659

(cherry picked from commit 9d50245a0f1333e10cc1c4dda16878cd79a7c42b)
DeltaFile
+2-0sys/riscv/include/ieeefp.h
+2-0sys/powerpc/include/ieeefp.h
+2-0sys/arm64/include/ieeefp.h
+2-0sys/arm/include/ieeefp.h
+1-0sys/amd64/include/ieeefp.h
+9-05 files

FreeBSD/src d2145e9 — sys/compat/linuxkpi/common/include/linux pm_runtime.h

LinuxKPI: restore several hard coded return values for the CONFIG_PM case

drm-kmod sets CONFIG_PM (unclear if for other parts) but LinuxKPI
has no understanding of a dev->power implementation for pm_runtime.h.

The return values based on !CONFIG_PM thus cause problems to drm-kmod.
Return the previous values under CONFIG_PM but leave the TODO logging
as the actual implementation is missing and return values may not be
universally correct (beyond the known drm-kmod use cases).

The following functions having a return value but none sepcific for
CONFIG_PM as (based on drm-kmod master):
pm_runtime_resume          only caller ignores the return value
pm_runtime_set_active      two callers ignore the return value
pm_runtime_put_autosuspend all callers seem to ignore the return value
pm_runtime_autosuspend     2/3 callers ignore the return value;
                           3rd is #ifdef __linux__
pm_runtime_suspended       3/4 callers ... do check the return value
                           but the logic expects the false, which also

    [7 lines not shown]
DeltaFile
+22-5sys/compat/linuxkpi/common/include/linux/pm_runtime.h
+22-51 files

FreeBSD/src 06abe08 — lib/libpam/modules/pam_exec pam_exec.c

pam_exec: fix the stderr close test and avoid a double close

The cleanup tested cherr[0] when closing cherr[1].  The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again.  Clear each fd after closing and test the right
one.

Reviewed by:    des, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D60924
DeltaFile
+10-4lib/libpam/modules/pam_exec/pam_exec.c
+10-41 files

FreeBSD/src 6f051f0 — usr.sbin/bhyve pci_emul.h pci_emul.c

bhyve: Treat BAR registration failures as non-fatal

Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes.  In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000.  This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.

Tolerate such overlaps.  Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.

This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.

PR:             290098
Reviewed by:    bnovkov

    [3 lines not shown]
DeltaFile
+31-15usr.sbin/bhyve/pci_emul.c
+2-0usr.sbin/bhyve/pci_emul.h
+33-152 files

FreeBSD/src 9ab2bf0 — usr.sbin/inetd inetd.c

inetd: use snprintf() in inetd_setproctitle()

inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60879
DeltaFile
+2-2usr.sbin/inetd/inetd.c
+2-21 files

FreeBSD/src 7410d52 — . ObsoleteFiles.inc

ObsoleteFiles.inc: Add dropped certificates

Approved by:    so
Security:       FreeBSD-SA-26:73.caroot
Reported by:    michaelo@
Fixes:          82af7f44ebef ("caroot: Regenerate")

(cherry picked from commit 21ac4761428c60c48bb5c3a0367a04dae164c414)
DeltaFile
+7-0ObsoleteFiles.inc
+7-01 files

FreeBSD/src bd31ee5 — . UPDATING, sys/conf newvers.sh

Add UPDATING entries and bump version

Approved by:    so
DeltaFile
+5-0UPDATING
+1-1sys/conf/newvers.sh
+6-12 files

FreeBSD/src 091c8ad — . ObsoleteFiles.inc

ObsoleteFiles.inc: Add moved certificates

These two moved from trusted to untrusted.

Approved by:    so
Security:       FreeBSD-SA-26:73.caroot
Fixes:          21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
(cherry picked from commit dd6a1fef0ed2bf760a294106ab93fbcdcfdcae3d)
DeltaFile
+2-0ObsoleteFiles.inc
+2-01 files

FreeBSD/src 96a1404 — secure/caroot/trusted ePKI_Root_Certification_Authority.pem SECOM_TLS_RSA_Root_CA_2024.pem, secure/caroot/untrusted SecureSign_Root_CA16.pem Telia_RSA_Email_Root_CA_v3.pem

caroot: Regenerate

Regenerate using certificate data from NSS 3.131.1.

Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.

Approved by:    so
Security:       FreeBSD-SA-26:73.caroot
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D60906

(cherry picked from commit 82af7f44ebefbe46cd635f63db300a066de48ee1)
DeltaFile
+135-0secure/caroot/untrusted/SECOM_SMIME_RSA_Root_CA_2024.pem
+0-134secure/caroot/trusted/ePKI_Root_Certification_Authority.pem
+134-0secure/caroot/trusted/SECOM_TLS_RSA_Root_CA_2024.pem
+134-0secure/caroot/trusted/Telia_RSA_TLS_Root_CA_v3.pem
+134-0secure/caroot/untrusted/Telia_RSA_Email_Root_CA_v3.pem
+132-0secure/caroot/untrusted/SecureSign_Root_CA16.pem
+669-13412 files not shown
+1,027-63818 files

FreeBSD/src 9686673 — secure/caroot/trusted SwissSign_Gold_CA_-_G2.pem QuoVadis_Root_CA_3.pem, secure/caroot/untrusted LuxTrust_Global_Root_2.pem QuoVadis_Root_CA_3.pem

caroot: Regenerate

Regenerate using certificate data from NSS 3.123.1.

Approved by:    so
Security:       FreeBSD-SA-26:73.caroot
MFC after:      1 week
Reviewed by:    kevans

(cherry picked from commit 07b52233e8b74c5ac884b9c9a894f57fad8dbd00)
(cherry picked from commit 09bb6a62d00f041079453f5e17a7387e3c0f3503)
DeltaFile
+0-149secure/caroot/untrusted/Chambers_of_Commerce_Root_-_2008.pem
+0-148secure/caroot/untrusted/Global_Chambersign_Root_-_2008.pem
+0-146secure/caroot/trusted/QuoVadis_Root_CA_3.pem
+146-0secure/caroot/untrusted/QuoVadis_Root_CA_3.pem
+0-138secure/caroot/untrusted/LuxTrust_Global_Root_2.pem
+0-138secure/caroot/trusted/SwissSign_Gold_CA_-_G2.pem
+146-719117 files not shown
+5,032-7,421123 files

FreeBSD/src 95719d8 — . UPDATING, sys/conf newvers.sh

Add UPDATING entries and bump version

Approved by:    so
DeltaFile
+5-0UPDATING
+1-1sys/conf/newvers.sh
+6-12 files

FreeBSD/src 10201c0 — . ObsoleteFiles.inc

ObsoleteFiles.inc: Add moved certificates

These two moved from trusted to untrusted.

Approved by:    so
Security:       FreeBSD-SA-26:73.caroot
Fixes:          21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
(cherry picked from commit dd6a1fef0ed2bf760a294106ab93fbcdcfdcae3d)
DeltaFile
+2-0ObsoleteFiles.inc
+2-01 files

FreeBSD/src 4058241 — sys/x86/x86 mp_x86.c

x86/mp_x86.c: unbreak COUNT_IPIS

Fixes:  3a0e2ca3eecd ("x86: ipi_bitmap_handler(): Account for IPIs correctly on COUNT_IPIS")
DeltaFile
+2-2sys/x86/x86/mp_x86.c
+2-21 files

FreeBSD/src 8dfa23d — sys/amd64/linux linux_sysvec.c, sys/amd64/linux32 linux32_sysvec.c

sys: centralize SV_* flags definitions for ELF Linux ABIs

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+1-3sys/i386/linux/linux_sysvec.c
+1-3sys/amd64/linux32/linux32_sysvec.c
+1-2sys/arm64/linux/linux_sysvec.c
+1-2sys/amd64/linux/linux_sysvec.c
+2-0sys/sys/sysent.h
+6-105 files

FreeBSD/src f69d974 — sys/amd64/amd64 elf_machdep.c, sys/arm/arm elf_machdep.c

sys: centralize SV_* flags definitions for several FreeBSD ABIs

The omitted ABI is compat32 on arm64, which lacks SV_ASLR.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+2-6sys/amd64/amd64/elf_machdep.c
+2-4sys/powerpc/powerpc/elf64_machdep.c
+1-3sys/compat/ia32/ia32_sysvec.c
+1-3sys/arm/arm/elf_machdep.c
+1-2sys/i386/i386/elf_machdep.c
+1-2sys/arm64/arm64/elf_machdep.c
+8-203 files not shown
+13-249 files