15 files changed, 242 insertions, 50 deletions

diff --git a/ObsoleteFiles.inc b/ObsoleteFiles.inc
index de25b6608fe6..ce39d8eee2e4 100644
--- a/ObsoleteFiles.inc
+++ b/ObsoleteFiles.inc
@@ -66,6 +66,9 @@ OLD_FILES+=usr/tests/usr.bin/xargs/regress.n2147483647.out
 # 20250728: Machine versions of 'runq.h' do not exist anymore
 OLD_FILES+=usr/include/machine/runq.h
 
+# 20250716: Remove an old manual page, vn(4) was removed in FreeBSD 5.0
+OLD_FILES+=usr/share/man/man4/vn.4.gz
+
 # 20250708: replace yaml.lua with lyaml
 OLD_FILES+=usr/share/flua/yaml.lua
 
diff --git a/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1 b/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
index eafc25f187d5..0ae8bf0d2bcb 100644
--- a/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
+++ b/cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
@@ -628,6 +628,52 @@ Same as the
 flag.
 .It Sy dynvarsize Ns = Ns Ar size
 Size of the dynamic variable space.
+.Sm off
+.It Sy evaltime = Cm exec | preinit | postinit | main
+.Sm on
+Process create mode.
+When using
+.Fl c Ar cmd
+to start a command,
+.Nm
+will first stop the newly started
+.Ar cmd ,
+evaluate the
+.Xr d 7
+program,
+and then resume the
+.Ar cmd .
+The
+.Cm evaltime
+option controls the exact moment when this happens.
+.Pp
+The following table describes supported modes.
+.Bl -column -offset indent "postinit" "D Program Evaluation Time"
+.It Sy Mode Ta Sy D Program Evaluation Time
+.It Cm exec Ta
+Right at the first instruction of the command
+.Ar cmd
+execution.
+.It Cm preinit Ta
+Before
+.Xr elf 5 Ap s
+.Dq .init
+sections.
+.It Cm postinit Ta
+After
+.Xr elf 5 Ap s
+.Dq .init
+sections.
+Default on
+.Fx .
+.It Cm main Ta
+Before the first instruction of the
+.Fn main
+function.
+.El
+.Pp
+Usually, there is no reason to change the default mode,
+but it might be handy in situations such as shared library tracing.
 .It Sy flowindent
 Turn on flow indentation.
 Same as the
diff --git a/lib/geom/part/gpart.8 b/lib/geom/part/gpart.8
index fa0b247c6174..c424ba1157d9 100644
--- a/lib/geom/part/gpart.8
+++ b/lib/geom/part/gpart.8
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd July 26, 2023
+.Dd October 24, 2025
 .Dt GPART 8
 .Os
 .Sh NAME
@@ -1501,6 +1501,26 @@ and
 .Bd -literal -offset indent
 /sbin/gpart backup ada0 | /sbin/gpart restore -F ada1 ada2
 .Ed
+.Sh DIAGNOSTICS
+.Bl -diag
+.It gpart: arg0 '%s': Invalid argument
+The provided
+.Ar geom
+argument
+is not a GEOM provider.
+Not every device in
+.Xr devfs 4
+is a GEOM provider.
+For example, a
+.Xr zfs 4
+zvol will show up as a GEOM provider only if its
+.Sy volmode
+is set properly
+.Po refer to
+.Xr zfsprops 8
+for details
+.Pc .
+.El
 .Sh SEE ALSO
 .Xr geom 4 ,
 .Xr boot0cfg 8 ,
diff --git a/release/tools/vmimage.subr b/release/tools/vmimage.subr
index 04c0d5bb2bb5..7a078e357adf 100644
--- a/release/tools/vmimage.subr
+++ b/release/tools/vmimage.subr
@@ -304,7 +304,11 @@ vm_create_disk() {
 		# Create an ESP
 		espfilename=$(mktemp /tmp/efiboot.XXXXXX)
 		make_esp_file ${espfilename} ${fat32min} ${BOOTFILES}/efi/loader_lua/loader_lua.efi
-		BOOTPARTS="${BOOTPARTS} -p efi/efiesp:=${espfilename}"
+		espsuffix=""
+		if [ -z "${BOOTPARTS}" ]; then
+			espsuffix="${BOOTPARTSOFFSET}"
+		fi
+		BOOTPARTS="${BOOTPARTS} -p efi/efiesp:=${espfilename}${espsuffix}"
 
 		# Add this to fstab
 		mkdir -p ${DESTDIR}/boot/efi
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index f5eca038e800..e677e42c22d1 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -723,7 +723,6 @@ MLINKS+=lge.4 if_lge.4
 MLINKS+=lo.4 loop.4
 MLINKS+=lp.4 plip.4
 MLINKS+=malo.4 if_malo.4
-MLINKS+=md.4 vn.4
 MLINKS+=mem.4 kmem.4
 MLINKS+=mfi.4 mfi_linux.4 \
 	mfi.4 mfip.4
diff --git a/share/man/man4/md.4 b/share/man/man4/md.4
index acd52aecb675..7d14279f6623 100644
--- a/share/man/man4/md.4
+++ b/share/man/man4/md.4
@@ -5,7 +5,7 @@
 .\" this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
 .\" ----------------------------------------------------------------------------
 .\"
-.Dd January 8, 2020
+.Dd July 16, 2025
 .Dt MD 4
 .Os
 .Sh NAME
@@ -158,7 +158,7 @@ installation process.
 The
 .Nm
 driver did a hostile takeover of the
-.Xr vn 4
+.Sy vn
 driver in
 .Fx 5.0 .
 .Sh AUTHORS
diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index 211c1150c909..148470e0934f 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -87,6 +87,7 @@ MAN=	accept_filter.9 \
 	DECLARE_MODULE.9 \
 	DEFINE_IFUNC.9 \
 	DELAY.9 \
+	deadfs.9 \
 	devclass.9 \
 	devclass_find.9 \
 	devclass_get_device.9 \
diff --git a/share/man/man9/atomic.9 b/share/man/man9/atomic.9
index df24cd4a4d2b..af94b5773f0e 100644
--- a/share/man/man9/atomic.9
+++ b/share/man/man9/atomic.9
@@ -182,35 +182,42 @@ This variant is the default.
 The second variant has acquire semantics, and the third variant has release
 semantics.
 .Pp
-When an atomic operation has acquire semantics, the operation must have
+An atomic operation can only have
+.Em acquire
+semantics if it performs a load
+from memory.
+When an atomic operation has acquire semantics, a load performed as
+part of the operation must have
 completed before any subsequent load or store (by program order) is
 performed.
 Conversely, acquire semantics do not require that prior loads or stores have
-completed before the atomic operation is performed.
-An atomic operation can only have acquire semantics if it performs a load
-from memory.
+completed before a load from the atomic operation is performed.
 To denote acquire semantics, the suffix
 .Dq Li _acq
 is inserted into the function name immediately prior to the
 .Dq Li _ Ns Aq Fa type
 suffix.
-For example, to subtract two integers ensuring that the subtraction is
+For example, to subtract two integers ensuring that the load of
+the value from memory is
 completed before any subsequent loads and stores are performed, use
 .Fn atomic_subtract_acq_int .
 .Pp
+An atomic operation can only have
+.Em release
+semantics if it performs a store to memory.
 When an atomic operation has release semantics, all prior loads or stores
-(by program order) must have completed before the operation is performed.
-Conversely, release semantics do not require that the atomic operation must
+(by program order) must have completed before a store executed as part of
+the operation that is performed.
+Conversely, release semantics do not require that a store from the atomic
+operation must
 have completed before any subsequent load or store is performed.
-An atomic operation can only have release semantics if it performs a store
-to memory.
 To denote release semantics, the suffix
 .Dq Li _rel
 is inserted into the function name immediately prior to the
 .Dq Li _ Ns Aq Fa type
 suffix.
 For example, to add two long integers ensuring that all prior loads and
-stores are completed before the addition is performed, use
+stores are completed before the store of the result is performed, use
 .Fn atomic_add_rel_long .
 .Pp
 When a release operation by one thread
@@ -235,6 +242,33 @@ section.
 However, they will not prevent the compiler or processor from moving loads
 or stores into the critical section, which does not violate the semantics of
 a mutex.
+.Ss Architecture-dependent caveats for compare-and-swap
+The
+.Fn atomic_[f]cmpset_<type>
+operations, specifically those without explicitly specified memory
+ordering, are defined as relaxed.
+Consequently, a thread's accesses to memory locations different from
+that of the atomic operation can be reordered in relation to the
+atomic operation.
+.Pp
+However, the implementation on the
+.Sy amd64
+and
+.Sy i386
+architectures provide sequentially consistent semantics.
+In particular, the reordering mentioned above cannot occur.
+.Pp
+On the
+.Sy arm64/aarch64
+architecture, the operation may include either acquire
+semantics on the constituent load or release semantics
+on the constituent store.
+This means that accesses to other locations in program order
+before the atomic, might be observed as executed after the load
+that is the part of the atomic operation (but not after the store
+from the operation due to release).
+Similarly, accesses after the atomic might be observed as executed
+before the store.
 .Ss Thread Fence Operations
 Alternatively, a programmer can use atomic thread fence operations to
 constrain the reordering of accesses.
diff --git a/share/man/man9/buf.9 b/share/man/man9/buf.9
index 975a1bf2074f..baf3d06db1b4 100644
--- a/share/man/man9/buf.9
+++ b/share/man/man9/buf.9
@@ -36,44 +36,70 @@ The kernel implements a KVM abstraction of the buffer cache which allows it
 to map potentially disparate vm_page's into contiguous KVM for use by
 (mainly file system) devices and device I/O.
 This abstraction supports
-block sizes from DEV_BSIZE (usually 512) to upwards of several pages or more.
+block sizes from
+.Dv DEV_BSIZE
+(usually 512) to upwards of several pages or more.
 It also supports a relatively primitive byte-granular valid range and dirty
 range currently hardcoded for use by NFS.
 The code implementing the
 VM Buffer abstraction is mostly concentrated in
-.Pa /usr/src/sys/kern/vfs_bio.c .
+.Pa sys/kern/vfs_bio.c
+in the
+.Fx
+source tree.
 .Pp
 One of the most important things to remember when dealing with buffer pointers
-(struct buf) is that the underlying pages are mapped directly from the buffer
+.Pq Vt struct buf
+is that the underlying pages are mapped directly from the buffer
 cache.
 No data copying occurs in the scheme proper, though some file systems
 such as UFS do have to copy a little when dealing with file fragments.
 The second most important thing to remember is that due to the underlying page
-mapping, the b_data base pointer in a buf is always *page* aligned, not
-*block* aligned.
-When you have a VM buffer representing some b_offset and
-b_size, the actual start of the buffer is (b_data + (b_offset & PAGE_MASK))
-and not just b_data.
+mapping, the
+.Va b_data
+base pointer in a buf is always
+.Em page Ns -aligned ,
+not
+.Em block Ns -aligned .
+When you have a VM buffer representing some
+.Va b_offset
+and
+.Va b_size ,
+the actual start of the buffer is
+.Ql b_data + (b_offset & PAGE_MASK)
+and not just
+.Ql b_data .
 Finally, the VM system's core buffer cache supports
-valid and dirty bits (m->valid, m->dirty) for pages in DEV_BSIZE chunks.
+valid and dirty bits
+.Pq Va m->valid , m->dirty
+for pages in
+.Dv DEV_BSIZE
+chunks.
 Thus
 a platform with a hardware page size of 4096 bytes has 8 valid and 8 dirty
 bits.
 These bits are generally set and cleared in groups based on the device
 block size of the device backing the page.
 Complete page's worth are often
-referred to using the VM_PAGE_BITS_ALL bitmask (i.e., 0xFF if the hardware page
+referred to using the
+.Dv VM_PAGE_BITS_ALL
+bitmask (i.e., 0xFF if the hardware page
 size is 4096).
 .Pp
 VM buffers also keep track of a byte-granular dirty range and valid range.
 This feature is normally only used by the NFS subsystem.
 I am not sure why it
-is used at all, actually, since we have DEV_BSIZE valid/dirty granularity
+is used at all, actually, since we have
+.Dv DEV_BSIZE
+valid/dirty granularity
 within the VM buffer.
-If a buffer dirty operation creates a 'hole',
+If a buffer dirty operation creates a
+.Dq hole ,
 the dirty range will extend to cover the hole.
 If a buffer validation
-operation creates a 'hole' the byte-granular valid range is left alone and
+operation creates a
+.Dq hole
+the byte-granular valid range is left alone and
 will not take into account the new extension.
 Thus the whole byte-granular
 abstraction is considered a bad hack and it would be nice if we could get rid
@@ -81,16 +107,24 @@ of it completely.
 .Pp
 A VM buffer is capable of mapping the underlying VM cache pages into KVM in
 order to allow the kernel to directly manipulate the data associated with
-the (vnode,b_offset,b_size).
+the
+.Pq Va vnode , b_offset , b_size .
 The kernel typically unmaps VM buffers the moment
-they are no longer needed but often keeps the 'struct buf' structure
-instantiated and even bp->b_pages array instantiated despite having unmapped
+they are no longer needed but often keeps the
+.Vt struct buf
+structure
+instantiated and even
+.Va bp->b_pages
+array instantiated despite having unmapped
 them from KVM.
 If a page making up a VM buffer is about to undergo I/O, the
-system typically unmaps it from KVM and replaces the page in the b_pages[]
+system typically unmaps it from KVM and replaces the page in the
+.Va b_pages[]
 array with a place-marker called bogus_page.
 The place-marker forces any kernel
-subsystems referencing the associated struct buf to re-lookup the associated
+subsystems referencing the associated
+.Vt struct buf
+to re-lookup the associated
 page.
 I believe the place-marker hack is used to allow sophisticated devices
 such as file system devices to remap underlying pages in order to deal with,
@@ -107,18 +141,29 @@ you wind up with pages marked clean that are actually still dirty.
 If not
 treated carefully, these pages could be thrown away!
 Indeed, a number of
-serious bugs related to this hack were not fixed until the 2.2.8/3.0 release.
-The kernel uses an instantiated VM buffer (i.e., struct buf) to place-mark pages
+serious bugs related to this hack were not fixed until the
+.Fx 2.2.8 /
+.Fx 3.0
+release.
+The kernel uses an instantiated VM buffer (i.e.,
+.Vt struct buf )
+to place-mark pages
 in this special state.
-The buffer is typically flagged B_DELWRI.
+The buffer is typically flagged
+.Dv B_DELWRI .
 When a
-device no longer needs a buffer it typically flags it as B_RELBUF.
+device no longer needs a buffer it typically flags it as
+.Dv B_RELBUF .
 Due to
-the underlying pages being marked clean, the B_DELWRI|B_RELBUF combination must
+the underlying pages being marked clean, the
+.Ql B_DELWRI|B_RELBUF
+combination must
 be interpreted to mean that the buffer is still actually dirty and must be
 written to its backing store before it can actually be released.
 In the case
-where B_DELWRI is not set, the underlying dirty pages are still properly
+where
+.Dv B_DELWRI
+is not set, the underlying dirty pages are still properly
 marked as dirty and the buffer can be completely freed without losing that
 clean/dirty state information.
 (XXX do we have to check other flags in
@@ -128,7 +173,9 @@ The kernel reserves a portion of its KVM space to hold VM Buffer's data
 maps.
 Even though this is virtual space (since the buffers are mapped
 from the buffer cache), we cannot make it arbitrarily large because
-instantiated VM Buffers (struct buf's) prevent their underlying pages in the
+instantiated VM Buffers
+.Pq Vt struct buf Ap s
+prevent their underlying pages in the
 buffer cache from being freed.
 This can complicate the life of the paging
 system.
diff --git a/share/man/man9/deadfs.9 b/share/man/man9/deadfs.9
new file mode 100644
index 000000000000..360451266625
--- /dev/null
+++ b/share/man/man9/deadfs.9
@@ -0,0 +1,36 @@
+.\"
+.\" SPDX-License-Identifier: BSD-2-Clause
+.\"
+.\" Copyright (c) 2025 Mateusz Piotrowski <0mp@FreeBSD.org>
+.\"
+.Dd October 24, 2025
+.Dt DEADFS 9
+.Os
+.Sh NAME
+.Nm deadfs
+.Nd pseudo-filesystem to own reclaimed vnodes
+.Sh DESCRIPTION
+The
+.Nm
+file system implements operations that do not modify any data
+and instead return indications of invalid IO.
+Its role is to provide a fallback vnode operations vector for reclaimed
+.Xr vnode 9 Ap s .
+.Pp
+It is a kernel-only pseudo-file system and so cannot be mounted from userspace.
+.Sh SEE ALSO
+.Xr insmntque 9 ,
+.Xr vnode 9 ,
+.Xr VOP_RECLAIM 9
+.Sh HISTORY
+UNIX System Manager's Manual (SMM) for
+.Bx 4.4
+described
+.Nm
+as a file system
+.Dq where rejected vnods go to die .
+.Sh AUTHORS
+The
+.Nm
+manual page was written by
+.An Mateusz Piotrowski Aq Mt 0mp@FreeBSD.org .
diff --git a/share/man/man9/vnode.9 b/share/man/man9/vnode.9
index 5dd087725e92..d17492668298 100644
--- a/share/man/man9/vnode.9
+++ b/share/man/man9/vnode.9
@@ -24,7 +24,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd October 9, 2024
+.Dd July 15, 2025
 .Dt VNODE 9
 .Os
 .Sh NAME
@@ -113,7 +113,7 @@ The
 function declarations and definitions are generated from
 .Pa sys/kern/vnode_if.src
 by the
-.Pa sys/tools/vndoe_if.awk
+.Pa sys/tools/vnode_if.awk
 script.
 The interfaces are documented in their respective manual pages like
 .Xr VOP_READ 9
diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c
index 1b434eda19a5..3057060d7adb 100644
--- a/sys/dev/md/md.c
+++ b/sys/dev/md/md.c
@@ -11,9 +11,9 @@
  */
 
 /*-
- * The following functions are based on the vn(4) driver: mdstart_swap(),
- * mdstart_vnode(), mdcreate_swap(), mdcreate_vnode() and mddestroy(),
- * and as such under the following copyright:
+ * The following functions are based on the historical vn(4) driver:
+ * mdstart_swap(), mdstart_vnode(), mdcreate_swap(), mdcreate_vnode()
+ * and mddestroy(), and as such under the following copyright:
  *
  * Copyright (c) 1988 University of Utah.
  * Copyright (c) 1990, 1993
diff --git a/sys/dev/usb/serial/u3g.c b/sys/dev/usb/serial/u3g.c
index 5154973cd9b3..fad352fc1f63 100644
--- a/sys/dev/usb/serial/u3g.c
+++ b/sys/dev/usb/serial/u3g.c
@@ -531,6 +531,7 @@ static const STRUCT_USB_HOST_ID u3g_devs[] = {
 	U3G_DEV(QUECTEL, RG520, 0),
 	U3G_DEV(QUECTEL, EC200, 0),
 	U3G_DEV(QUECTEL, EC200S, 0),
+	U3G_DEV(QUECTEL, EM060K, 0),
 	U3G_DEV(QUECTEL, EC200T, 0),
 	U3G_DEV(QUECTEL, UC200, 0),
 	U3G_DEV(SIERRA, AC402, 0),
diff --git a/sys/dev/usb/usbdevs b/sys/dev/usb/usbdevs
index cefd0ac5df43..fa201f448fd6 100644
--- a/sys/dev/usb/usbdevs
+++ b/sys/dev/usb/usbdevs
@@ -4073,6 +4073,7 @@ product QUECTEL RG500		0x0800	Quectel RG500/RM500/RG510/RM510
 product QUECTEL RG520		0x0801	Quectel RG520/RM520/SG520
 product QUECTEL EC200		0x6000	Quectel EC200/UC200
 product QUECTEL EC200S		0x6002	Quectel EC200S
+product QUECTEL EM060K		0x6008	Quectel EM060K
 product QUECTEL EC200T		0x6026	Quectel EC200T
 product QUECTEL UC200		0x6120	Quectel UC200
 
diff --git a/sys/kern/subr_syscall.c b/sys/kern/subr_syscall.c
index 25843eec3754..139a4df57f13 100644
--- a/sys/kern/subr_syscall.c
+++ b/sys/kern/subr_syscall.c
@@ -57,8 +57,8 @@ syscallenter(struct thread *td)
 	struct proc *p;
 	struct syscall_args *sa;
 	struct sysent *se;
-	int error, traced;
-	bool sy_thr_static;
+	int error;
+	bool sy_thr_static, traced;
 
 	VM_CNT_INC(v_syscall);
 	p = td->td_proc;
@@ -217,7 +217,7 @@ syscallret(struct thread *td)
 	struct proc *p;
 	struct syscall_args *sa;
 	ksiginfo_t ksi;
-	int traced;
+	bool traced;
 
 	KASSERT(td->td_errno != ERELOOKUP,
 	    ("ERELOOKUP not consumed syscall %d", td->td_sa.code));
@@ -248,9 +248,9 @@ syscallret(struct thread *td)
 	}
 #endif
 
-	traced = 0;
+	traced = false;
 	if (__predict_false(p->p_flag & P_TRACED)) {
-		traced = 1;
+		traced = true;
 		PROC_LOCK(p);
 		td->td_dbgflags |= TDB_SCX;
 		PROC_UNLOCK(p);