FreeBSD/src 95c04b2sys/arm/broadcom/bcm2835 bcm2835_audio.c

bcm2835_audio: Comment out vchi_service_release()

bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.

In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.

vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.

PR:             297187
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58921
DeltaFile
+1-1sys/arm/broadcom/bcm2835/bcm2835_audio.c
+1-11 files

FreeBSD/src 7cc6a5dcontrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
(cherry picked from commit 86aea5b4db379327f02ca547575105788bfbe807)

Approved by:    re (cperciva)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files

FreeBSD/src 3a1396acontrib/less option.c cmdbuf.c

MFV less v691

Relnotes:       yes

(cherry picked from commit dafba19e42e78cd3d7c9264ece49ddd3d7d70da5)

MFV: less v692.

(cherry picked from commit e2abec625bf07c054f7ac2df2402d6c454113df8)
(cherry picked from commit 6330c2f5fbbf1320d768fa55f267c114654d729b)

Approved by:    re (cperciva)
DeltaFile
+1,017-476contrib/less/less.nro
+374-153contrib/less/screen.c
+245-144contrib/less/lesskey.nro
+107-51contrib/less/mark.c
+70-68contrib/less/option.c
+81-57contrib/less/cmdbuf.c
+1,894-94958 files not shown
+2,855-1,45464 files

FreeBSD/src 0256ea4sbin/nvmecontrol power.c, sbin/nvmecontrol/modules/wdc wdc.c

nvmecontrol: Add SPDX-License-Identifier tags

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55275

(cherry picked from commit f8517c21d57f1db005c0d15e14d16252e8e4bfd0)
DeltaFile
+2-0sbin/nvmecontrol/power.c
+2-0sbin/nvmecontrol/modules/wdc/wdc.c
+4-02 files

FreeBSD/src 228b410usr.sbin/bhyve/amd64 atkbdc.h

bhyve: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation

(cherry picked from commit 499d0f04f55e52327d624d27ead3a0d16e3b465a)
DeltaFile
+2-0usr.sbin/bhyve/amd64/atkbdc.h
+2-01 files

FreeBSD/src ef55753sbin/decryptcore decryptcore.c

decryptcore: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55270

(cherry picked from commit 299d3e944a15cbffc8ed16a49869e1eaec1fb493)
DeltaFile
+2-0sbin/decryptcore/decryptcore.c
+2-01 files

FreeBSD/src cd9810fsys/dev/sound/pci vibes.c csavar.h, sys/dev/sound/pcm dsp.c

sound: Use unsigned long instead of legacy u_long

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

(cherry picked from commit afe56ee24679d6584acf02dd17f6ed52c052abe7)
DeltaFile
+22-21sys/dev/sound/pci/csapcm.c
+12-10sys/dev/sound/pci/csa.c
+6-6sys/dev/sound/pci/csavar.h
+3-3sys/dev/sound/pcm/dsp.c
+3-2sys/dev/sound/usb/uaudio.c
+3-2sys/dev/sound/pci/vibes.c
+49-446 files not shown
+61-5412 files

FreeBSD/src 644990fshare/examples/jails jng

New version of jng (9.0)

Changes for jng 2.0 -> 9.0 include:

+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
  mapping table stays small (first hook is uplink; unknown unicast
  goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
  NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
  cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026

See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.

MFC after:      1 week
Reviewed by:    kfv, jlduran
Differential Revision:  https://reviews.freebsd.org/D58903
DeltaFile
+230-113share/examples/jails/jng
+230-1131 files

FreeBSD/src b385e49. INSTALL.md, doc atf-test-case.7

Import files missed in previous imports

Fixes:  0c9bf043 ("vendor/atf: import atf-0.24-rc1")
DeltaFile
+1,070-0m4/ac_cxx_compile_stdcxx.m4
+328-0doc/atf-test-case.7
+219-0INSTALL.md
+1,617-03 files

FreeBSD/src 5e0e6a9sys/kern uipc_usrreq.c

unix: wrap comments to fit in 80 char line

Fixes:  6563dcb6b1f57e51db63854f3774b52e672232ed
DeltaFile
+4-4sys/kern/uipc_usrreq.c
+4-41 files

FreeBSD/src b567434stand/efi/boot1 zfs_module.c, stand/libsa/zfs zfs.c zfsimpl.c

stand: set st_dev/st_ino in the loader's ZFS stat for veriexec

The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.

Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:

- st_dev = the dataset's ds_fsid_guid (as the kernel does via
  dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
  zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
  through struct file (the loader's equivalent of the kernel's z_id).

dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly

    [14 lines not shown]
DeltaFile
+48-6stand/libsa/zfs/zfsimpl.c
+5-3stand/libsa/zfs/zfs.c
+3-2stand/efi/boot1/zfs_module.c
+56-113 files

FreeBSD/src b39457bsys/dev/virtio/p9fs virtio_p9fs.c

virtio_p9fs: Disallow detach if a session is in progress

PR:             295453
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57500
DeltaFile
+4-0sys/dev/virtio/p9fs/virtio_p9fs.c
+4-01 files

FreeBSD/src c08a97fsys/netpfil/ipfilter/netinet ip_nat.c

ipfilter: Fix checksum update for NAT_DIVERTOUT

When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.

PR:             296944
MFC after:      3 days
DeltaFile
+1-1sys/netpfil/ipfilter/netinet/ip_nat.c
+1-11 files

FreeBSD/src 7334d92share/man/man4 Makefile

share/man/man4: Move non-USB man pages out of MK_USB block

uart(4), unix(4) and the gzero(4) MLINK are not USB things, but they
were in the .if ${MK_USB} != "no" block.  So if we build with
WITHOUT_USB, these man pages are lost.  Move them out of the block.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
DeltaFile
+3-3share/man/man4/Makefile
+3-31 files

FreeBSD/src fd8ca3dshare/man/man4 Makefile

share/man/man4: Move non-USB man pages out of MK_USB block

uart(4), unix(4), veriexec(4) and the gzero(4) MLINK are not USB
things, but they were in the .if ${MK_USB} != "no" block.  So if we
build with WITHOUT_USB, these man pages are lost.  Move them out of
the block.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
DeltaFile
+4-4share/man/man4/Makefile
+4-41 files

FreeBSD/src 31f9f09lib/libc/tests/gen Makefile fts_capsicum_test.c

fts: add fts_capsicum_test.c

Add three test cases verifying fts(3) Capsicum capability mode:

- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
  entries and openat(fts_dirfd, fts_name) identifies the same
  inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
  Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
  at all directory depths (7 non-root entries)

Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2332
DeltaFile
+210-0lib/libc/tests/gen/fts_capsicum_test.c
+1-0lib/libc/tests/gen/Makefile
+211-02 files

FreeBSD/src 44cddaasys/dev/netmap if_ptnet.c, sys/dev/virtio/network if_vtnet.c virtio_net.h

vtnet: move offload functions to virtio_net.h to share them

Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.

Reviewed by:            tuexen
MFC after:              1 month
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D57299
DeltaFile
+196-169sys/dev/virtio/network/virtio_net.h
+49-296sys/dev/virtio/network/if_vtnet.c
+19-3sys/dev/netmap/if_ptnet.c
+17-2sys/net/if_tuntap.c
+281-4704 files

FreeBSD/src 3f3f452usr.sbin/pmcstat pmcstat.8

pmcstat.8: Add a missing ERRORS section header

MFC after:      3 days
Sponsored by:   fme AG

(cherry picked from commit 5729a0b45cd1a24c8b82d161de4711b4e004498d)
DeltaFile
+2-2usr.sbin/pmcstat/pmcstat.8
+2-21 files

FreeBSD/src 81cf13f. configure, admin ltmain.sh config.guess

vendor/atf: import atf-0.24-rc2

This version incorporates some of the local changes which had not yet
made it upstream into the RC1 code.

Obtained from:          https://github.com/freebsd/atf/releases/tag/atf-0.24-rc2
DeltaFile
+1,477-925admin/config.sub
+936-601admin/config.guess
+601-159m4/libtool.m4
+417-211configure
+245-80admin/ltmain.sh
+8-110atf-c/detail/fs.c
+3,684-2,0868 files not shown
+3,874-2,15514 files

FreeBSD/src 33e2eacsys/dev/ixgbe if_ix.c

ix(4): Sanitize negative error codes

Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>

Reviewed by:    kbowling, erj, milosz.linkiewicz_intel.com
Tested by:      Mateusz Moga <mateusz.moga at intel.com>
MFC after:      1 week
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D57642
DeltaFile
+19-4sys/dev/ixgbe/if_ix.c
+19-41 files

FreeBSD/src 189ee41sys/arm64/arm64 vfp.c

arm64 vfp: eliminate nested critical sections

At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable().  So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().

Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58859
DeltaFile
+3-4sys/arm64/arm64/vfp.c
+3-41 files

FreeBSD/src 68091ebsys/dev/ufshci ufshci_sim.c

ufshci: report the highest LUN number in the path inquiry

cpi->max_lun is an inclusive upper bound, but the driver reported the
LUN count (8 or 32), so CAM probed one nonexistent LUN past the end.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58820
DeltaFile
+1-1sys/dev/ufshci/ufshci_sim.c
+1-11 files

FreeBSD/src 3451829sys/dev/ufshci ufshci_reg.h

ufshci: correct the crypto/config register offsets and HCMID fields

The reserved array after CCAP must be 508, but it was 511.
This pushed the config, MCQ config, and ESI registers from 0x300 and
0x380 up to 0x900. None of these registers are used yet, so nothing
broke.

Also fix the HCMID bank index field. The spec places it at bits
[23:16], but it was defined on top of the manufacturer code at [15:0].

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58819
DeltaFile
+20-3sys/dev/ufshci/ufshci_reg.h
+20-31 files

FreeBSD/src e1aa173sys/dev/ufshci ufshci_dev.c

ufshci: consolidate the device query submit/poll pattern

The six query helpers duplicated the same submit, error check, poll,
and status check sequence. Move it into ufshci_dev_send_query() so
future changes to the query flow are made in one place. This also
unifies the failure log message format.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58818
DeltaFile
+28-70sys/dev/ufshci/ufshci_dev.c
+28-701 files

FreeBSD/src f3c3db3sys/dev/ufshci ufshci_sim.c

ufshci: validate the CDB before allocating a request

The CDB pointer and length checks depend only on the CCB, so perform
them before allocating and initializing the request. This avoids a
wasted allocation for invalid CCBs on the I/O path and removes one
request-free error path.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58817
DeltaFile
+11-11sys/dev/ufshci/ufshci_sim.c
+11-111 files

FreeBSD/src dbcebc7sys/dev/ufshci ufshci_req_sdb.c

ufshci: pass the queue being destroyed to the cmd descriptor teardown

ufshci_req_sdb_destroy() hardcoded &ctrlr->transfer_req_queue when
destroying command descriptors instead of using its req_queue argument.

No functional change: the branch only runs for the transfer queue, so
the two pointers are always the same today. Using the argument keeps
the function queue-agnostic for when more transfer queues exist (MCQ).

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58816
DeltaFile
+1-2sys/dev/ufshci/ufshci_req_sdb.c
+1-21 files

FreeBSD/src a508a9fsys/dev/ufshci ufshci_req_sdb.c

ufshci: return the real errno from SDB queue construction

ufshci_req_sdb_cmd_desc_construct() and ufshci_req_sdb_construct()
returned ENOMEM for every failure, so an EINVAL from bus_dma_tag_create()
was reported as a memory shortage. Capture and return the real errno,
and drop the cmd descriptor construct's now pointless out label.

No functional change: no caller inspects the value beyond propagating
it, so this only improves the diagnostics on an attach failure.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58815
DeltaFile
+21-18sys/dev/ufshci/ufshci_req_sdb.c
+21-181 files

FreeBSD/src 86aea5bcontrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files

FreeBSD/src 6330c2fcontrib/less option.c cmdbuf.c

MFV less v691

Relnotes:       yes

(cherry picked from commit dafba19e42e78cd3d7c9264ece49ddd3d7d70da5)

MFV: less v692.

(cherry picked from commit e2abec625bf07c054f7ac2df2402d6c454113df8)
DeltaFile
+1,017-476contrib/less/less.nro
+374-153contrib/less/screen.c
+245-144contrib/less/lesskey.nro
+107-51contrib/less/mark.c
+70-68contrib/less/option.c
+81-57contrib/less/cmdbuf.c
+1,894-94958 files not shown
+2,855-1,45464 files

FreeBSD/src c620652contrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files