From aly at crater.dragonflybsd.org  Tue Sep  1 05:45:17 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 05:45:17 -0700 (PDT)
Subject: git: kern: Fix memory leak in kdmsg_iocom_uninit()
Message-ID: <20260901124518.1D8A732E8D08@crater.dragonflybsd.org>


commit bfcedfb468d712f29cadb491bec0928ad4279bad
Author: Antonio Huete Jimenez <tuxillo at quantumachine.net>
Date:   Fri Dec 19 00:56:11 2025 +0100

    kern: Fix memory leak in kdmsg_iocom_uninit()
    
    When kdmsg_iocom_uninit() is called but no connection was ever
    established (no reader/writer threads), a PING message was allocated and
    queued but never freed. This caused a 120-byte leak from the HAMMER2-msg
    allocator on shutdown.
    
    Fix this by calling kdmsg_drain_msgq() to clean up any queued messages.
    
    This fixes the 'malloc_uninit: 120 bytes of HAMMER2-msg still allocated'
    warning.  Note that this warning already disappeared after fixing the
    hammer2_ioctl_recluster() bug in commit
    c5cc81fefa166cc45657541c155797f0cff88c62.
    
    Bug: https://bugs.dragonflybsd.org/issues/3385

Summary of changes:
 sys/kern/kern_dmsg.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/bfcedfb468d712f29cadb491bec0928ad4279bad


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:01 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:01 -0700 (PDT)
Subject: git: nvmm(4): Optimize the WCR8 intercept on SVM
Message-ID: <20260901130903.681D032E8DDF@crater.dragonflybsd.org>


commit f809bb0e5f9a9519193dc8b1b3f61f4485ed0228
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 14:09:13 2026 +0800

    nvmm(4): Optimize the WCR8 intercept on SVM
    
    Establish it only on demand, not by default. This saves one branch
    in svm_exit_wcr8(), which is a bit of a hot path on Windows guests.
    
    Add a unit test for it.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c            |  42 +--
 test/testcases/libnvmm/Makefile                    |   2 +-
 test/testcases/libnvmm/dfregress.run               |   1 +
 test/testcases/libnvmm/{h_io_assist.c => h_misc.c} | 291 +++++++++------------
 .../libnvmm/{h_io_assist => h_misc}/Makefile       |   4 +-
 .../common.h => testcases/libnvmm/h_misc_asm.S}    |  29 +-
 6 files changed, 163 insertions(+), 206 deletions(-)
 copy test/testcases/libnvmm/{h_io_assist.c => h_misc.c} (61%)
 copy test/testcases/libnvmm/{h_io_assist => h_misc}/Makefile (61%)
 copy test/{nvmm/demo/toyvirt/common.h => testcases/libnvmm/h_misc_asm.S} (73%)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/f809bb0e5f9a9519193dc8b1b3f61f4485ed0228


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Fix boundary error in nvmm_gpa_unmap()
Message-ID: <20260901130903.7F9CB32E8DE1@crater.dragonflybsd.org>


commit 1b3c3ec9bff9ec99c6197efd2c861a9c4bead893
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 14:17:15 2026 +0800

    nvmm(4): Fix boundary error in nvmm_gpa_unmap()
    
    A boundary error made it impossible to unmap the last page. Fix it,
    and add a test for it.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/nvmm.c     |  2 +-
 test/testcases/libnvmm/h_misc.c | 57 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/1b3c3ec9bff9ec99c6197efd2c861a9c4bead893


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Fix the outer VCPU loop
Message-ID: <20260901130903.9CE4732E8DE4@crater.dragonflybsd.org>


commit a76742a2bcf565efe054e5ab5881bac9f84bd977
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:17:18 2026 +0800

    nvmm(4): Fix the outer VCPU loop
    
    The outer VCPU loop can return to userland without entering the
    inner VMX/SVM loop. The problem is, this leaves the exitstate
    structure empty, which can cause Qemu to intermittently observe
    an incorrect guest interrupt state.
    
    Fix this by evaluating os_return_needed() after the inner loop
    is guaranteed to have been entered.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/nvmm.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a76742a2bcf565efe054e5ab5881bac9f84bd977


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Fix memory leak on machine destruction
Message-ID: <20260901130903.B5A0132E8DE7@crater.dragonflybsd.org>


commit d9a8fdad9a31f39c726187948e23e80a1262c6b6
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:22:13 2026 +0800

    nvmm(4): Fix memory leak on machine destruction
    
    The comm vmobj was not being freed on machine destruction. Introduce
    a new nvmm_do_machine_destroy() helper, free the comm vmobj in it,
    and use it in nvmm_machine_destroy() and nvmm_kill_machines().
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/nvmm.c | 97 ++++++++++++++++++++-------------------------
 1 file changed, 44 insertions(+), 53 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d9a8fdad9a31f39c726187948e23e80a1262c6b6


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Fix hmapping leak on HVA mapping failure
Message-ID: <20260901130903.CE12332E8DEA@crater.dragonflybsd.org>


commit 064dc45e4d2ffe5b8bdb8530772805a9d0b4f78d
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:25:40 2026 +0800

    nvmm(4): Fix hmapping leak on HVA mapping failure
    
    Free the hmapping if the HVA mapping fails. Otherwise, after
    NVMM_MAX_HMAPPINGS (32) failures no hmappings are available anymore. The
    emulator can't establish additional mappings and has to destroy the
    machine (which releases the hmappings).
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/nvmm.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/064dc45e4d2ffe5b8bdb8530772805a9d0b4f78d


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Sync minor fixes and changes
Message-ID: <20260901130903.E798832E8DED@crater.dragonflybsd.org>


commit 367f2648d918b19a0578e9eaf6ff1ea320cb3b00
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:32:27 2026 +0800

    nvmm(4): Sync minor fixes and changes
    
    - Fix the CR{3,8} read/write exiting control names for consistency.
    - Fix the VMX_QUAL_CR_LMSW_SRC macro, harmless because unused.
    - Fetch VMX_INFO_IO_SEG only on OUTS, otherwise it has an undefined
      value.
    - Define all EFER bits.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/x86/nvmm_x86_internal.h | 10 +++++++++
 sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c      |  7 ++++--
 sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c      | 32 ++++++++++++++++------------
 3 files changed, 33 insertions(+), 16 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/367f2648d918b19a0578e9eaf6ff1ea320cb3b00


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:03 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:03 -0700 (PDT)
Subject: git: nvmm(4): Improve OS independence
Message-ID: <20260901130904.11D3D32E8DF0@crater.dragonflybsd.org>


commit d9d69d1c765c0523630fed956257e5b3694019ed
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:43:18 2026 +0800

    nvmm(4): Improve OS independence
    
    - Introduce os_time() to get system time.
    - Introduce os_vmmap_t and os_vmspace_get_vmmap() for mapping.
    - Dynamically allocate hsave[] and vmxoncpu[] so they don't rely
      on a constant OS_MAXCPUS.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 sys/dev/virtual/nvmm/nvmm.c             | 10 +++++++---
 sys/dev/virtual/nvmm/nvmm_dragonfly.c   | 10 ++++++++--
 sys/dev/virtual/nvmm/nvmm_netbsd.c      | 10 ++++++++--
 sys/dev/virtual/nvmm/nvmm_os.h          | 13 +++++++++++--
 sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c | 14 ++++++++++----
 sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c | 14 ++++++++++----
 6 files changed, 54 insertions(+), 17 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d9d69d1c765c0523630fed956257e5b3694019ed


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: nvmm(4): Rename 'ncpus' in *_inkernel_handle_cpuid() to fix
 -Wshadow
Message-ID: <20260901130904.2A71632E8DFC@crater.dragonflybsd.org>


commit 6a728b6637c47c7f1795b42a1b967bcaff26490b
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 23:45:30 2026 +0800

    nvmm(4): Rename 'ncpus' in *_inkernel_handle_cpuid() to fix -Wshadow

Summary of changes:
 sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c | 10 +++++-----
 sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c | 18 +++++++++---------
 2 files changed, 14 insertions(+), 14 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/6a728b6637c47c7f1795b42a1b967bcaff26490b


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: nvmm(4): Improve HOST_RESTORE_TR to save an unnecessary movzwq
Message-ID: <20260901130904.4295732E8E0E@crater.dragonflybsd.org>


commit 48d7dfabb6594926387d924ea726ba2d438f0b44
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 21:06:53 2026 +0800

    nvmm(4): Improve HOST_RESTORE_TR to save an unnecessary movzwq
    
    Reviewed-by: dillon

Summary of changes:
 sys/dev/virtual/nvmm/x86/nvmm_x86_svmfunc.S | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/48d7dfabb6594926387d924ea726ba2d438f0b44


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: testcases/libnvmm: Remove the two RIP-relative addressing tests
Message-ID: <20260901130904.5B16332E8E11@crater.dragonflybsd.org>


commit 1275f1528422f0f77d07fcd78a242b91f31c7184
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 19:20:10 2026 +0800

    testcases/libnvmm: Remove the two RIP-relative addressing tests
    
    This reverts commit dea513a396514e21fa2cb677cd1e42929283d797 where I
    added these two commits, which only helped validate the instruction
    decoder and thus were not important.  Remove them to keep in sync with
    the upstream NVMM Reference Implementation.

Summary of changes:
 test/testcases/libnvmm/h_mem_assist.c     |  6 ---
 test/testcases/libnvmm/h_mem_assist_asm.S | 66 -------------------------------
 2 files changed, 72 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/1275f1528422f0f77d07fcd78a242b91f31c7184


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Fix segment limits calc and support expand-down
 segments
Message-ID: <20260901130904.746BE32E8E1B@crater.dragonflybsd.org>


commit 7a50a5b05c268d3438aba3fa95d625788508a099
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 20:23:29 2026 +0800

    libnvmm(3): Fix segment limits calc and support expand-down segments
    
    The SVM/VMX hardware already calculates the segment limits in bytes
    taking the G bit into account, so fix the emulator not to miscompute
    the limits, and add a unit-test to ensure correctness.
    
    Support expand-down segments and extend the 32bit segment limit
    unit-test to ensure correctness.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c                 |  27 ++--
 test/testcases/libnvmm/h_mem_assist.c     | 246 ++++++++++++++++++++++++++++++
 test/testcases/libnvmm/h_mem_assist_asm.S |  19 +++
 3 files changed, 283 insertions(+), 9 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7a50a5b05c268d3438aba3fa95d625788508a099


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Fix the emulation of PAE 2MB large pages
Message-ID: <20260901130904.8BE2B32E8E25@crater.dragonflybsd.org>


commit 1196bd56704a77b0f944970321ae1227e8662303
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 20:26:20 2026 +0800

    libnvmm(3): Fix the emulation of PAE 2MB large pages
    
    The definitions of the PAE frame masks were incorrect: in PAE the
    PTEs are 64bit-wide, not 32bit-wide. Fix this.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/1196bd56704a77b0f944970321ae1227e8662303


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Remove unused GVA computation artifacts
Message-ID: <20260901130904.AD9D832E8E30@crater.dragonflybsd.org>


commit 9f24219b105b63a8cb35002b49ac535a4afca72f
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 20:42:37 2026 +0800

    libnvmm(3): Remove unused GVA computation artifacts
    
    On single-memory-operand instructions, we use the GPA provided by
    the hardware and discard the GVA. The code that calculates the GVA
    is therefore effectively unused. Remove it.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 174 +++++++++-------------------------------------
 1 file changed, 34 insertions(+), 140 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9f24219b105b63a8cb35002b49ac535a4afca72f


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Fix sign-extension on RCX and RDI/RSI
Message-ID: <20260901130904.CD2CD32E8E33@crater.dragonflybsd.org>


commit d605e8301cded6bc09e3127af6489f83046a4e86
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 21:46:40 2026 +0800

    libnvmm(3): Fix sign-extension on RCX and RDI/RSI
    
    * Fix sign-extension on RCX when using the REP prefix.
    * Fix sign-extension on RDI/RSI when emulating MOVS.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c                 | 56 ++++++++++++++++++++++++-------
 test/testcases/libnvmm/h_mem_assist.c     |  4 +++
 test/testcases/libnvmm/h_mem_assist_asm.S | 42 +++++++++++++++++++++++
 3 files changed, 89 insertions(+), 13 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d605e8301cded6bc09e3127af6489f83046a4e86


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Fix zero-extension on RDI/RSI
Message-ID: <20260901130904.E834632E8E3E@crater.dragonflybsd.org>


commit e801c63e05169b31041abac7c84ec3bc49d502cd
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 31 21:57:04 2026 +0800

    libnvmm(3): Fix zero-extension on RDI/RSI
    
    * Fix zero-extension on RDI/RSI when emulating INS/OUTS.
    * Fix zero-extension on RDI/RSI when emulating LODS/STOS.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c                 | 39 ++++++++++++++-----------------
 test/testcases/libnvmm/h_io_assist.c      |  3 +++
 test/testcases/libnvmm/h_io_assist_asm.S  | 21 +++++++++++++++++
 test/testcases/libnvmm/h_mem_assist_asm.S | 11 +++++++--
 4 files changed, 51 insertions(+), 23 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/e801c63e05169b31041abac7c84ec3bc49d502cd


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:04 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:04 -0700 (PDT)
Subject: git: libnvmm(3): Remove unneeded segment checks on CS
Message-ID: <20260901130905.13E2A32E8E48@crater.dragonflybsd.org>


commit 7ae9bfc117a5868e580708ac4cda76104b831050
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 08:58:27 2026 +0800

    libnvmm(3): Remove unneeded segment checks on CS
    
    If the CS attributes did not allow the instruction to execute,
    then the guest would have received an internal #GP and we wouldn't
    have received an IO/MMIO VMEXIT. So no need to validate the CS
    attributes.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7ae9bfc117a5868e580708ac4cda76104b831050


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: libnvmm(3): Use volatile when accessing guest memory
Message-ID: <20260901130905.45BD532E8E6F@crater.dragonflybsd.org>


commit b01f5c07f8058ca8d5078e7624fbf917bd0e0350
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:05:47 2026 +0800

    libnvmm(3): Use volatile when accessing guest memory
    
    To preserve implicit atomicity.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 52 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 50 insertions(+), 2 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/b01f5c07f8058ca8d5078e7624fbf917bd0e0350


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: libnvmm(3): Allow partial fetches of instructions
Message-ID: <20260901130905.5FE9F32E8E73@crater.dragonflybsd.org>


commit d67308d23586d6dba7113c07a117be849ad0d245
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:09:32 2026 +0800

    libnvmm(3): Allow partial fetches of instructions
    
    An instruction may end at the boundary of a page followed by an
    unmapped page. In that case, fetching the full 15-byte maximum
    instruction length should not cause the assist to fail.
    
    Allow partial instruction fetches to succeed, and add a unit-test
    for that.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c             | 80 +++++++++++++++++------------------
 test/testcases/libnvmm/h_mem_assist.c | 50 ++++++++++++++++++++++
 2 files changed, 89 insertions(+), 41 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d67308d23586d6dba7113c07a117be849ad0d245


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: libnvmm(3): Truncate segment bases when running in non-64bit mode
Message-ID: <20260901130905.7899032E8E76@crater.dragonflybsd.org>


commit b190f6624bb79ce93102f2961c361915ddf5b960
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:11:07 2026 +0800

    libnvmm(3): Truncate segment bases when running in non-64bit mode
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 47 +++++++++++++++++++++++++----------------------
 1 file changed, 25 insertions(+), 22 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/b190f6624bb79ce93102f2961c361915ddf5b960


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: libnvmm(3): Fix EXEC_INSTR()
Message-ID: <20260901130905.924A632E8E7D@crater.dragonflybsd.org>


commit f677fea937108d85fee4c67968a1a7eeb77d912f
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:11:57 2026 +0800

    libnvmm(3): Fix EXEC_INSTR()
    
    - op2 is overwritten, so it needs "+r".
    - RFLAGS is modified, so it needs "cc".
    - PUSHFQ touches memory, so it needs "memory".
    - The MOV is not needed, so remove it.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 lib/libnvmm/libnvmm_x86.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/f677fea937108d85fee4c67968a1a7eeb77d912f


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: libnvmm(3): Sync misc changes
Message-ID: <20260901130905.AAADC32E8E80@crater.dragonflybsd.org>


commit eab5bd070f0fabff9b05cd8666ffd23d4f777b45
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:13:56 2026 +0800

    libnvmm(3): Sync misc changes
    
    - Replace EPROGMISMATCH by the standard ENOSYS.
    - Remove finished TODO items; and move the remaining TODO items to the
      code.
    
    Obtained-from: NVMM Reference Implementation

Summary of changes:
 doc/TODO.nvmm             | 13 -------------
 lib/libnvmm/libnvmm.c     |  8 ++++++--
 lib/libnvmm/libnvmm_x86.c | 13 ++++++++++++-
 3 files changed, 18 insertions(+), 16 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/eab5bd070f0fabff9b05cd8666ffd23d4f777b45


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 06:09:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 06:09:05 -0700 (PDT)
Subject: git: nvmm: Minor cleanups
Message-ID: <20260901130905.C311732E8E84@crater.dragonflybsd.org>


commit 42aaacafd14ddb7f660730a5ca5da0a2d941723a
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Sep 1 09:18:03 2026 +0800

    nvmm: Minor cleanups

Summary of changes:
 lib/libnvmm/nvmm.h                          | 2 --
 sys/dev/virtual/nvmm/x86/nvmm_x86_svmfunc.S | 3 +--
 test/testcases/libnvmm/h_os.h               | 1 -
 3 files changed, 1 insertion(+), 5 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/42aaacafd14ddb7f660730a5ca5da0a2d941723a


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:48:36 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:48:36 -0700 (PDT)
Subject: git: hammer2: Disable debug v/f-chain dumps on unmounting
Message-ID: <20260902054836.E840032EB02E@crater.dragonflybsd.org>


commit 40e5c5625b097fde74fad7c8503aea083208630a
Author: Aaron LI <aly at aaronly.me>
Date:   Wed Sep 2 09:14:20 2026 +0800

    hammer2: Disable debug v/f-chain dumps on unmounting
    
    The two dumps were added to track down the HAMMER2-msg leak reported by
    malloc_uninit() and would always print the following logs at shutdown:
    
    ```
    v-chain 0xfffff8008e6204c0 volume.0   0000000000000010 0000000000000000/0  mir=00000000000
    00140
          [00002000] (?) refs=1
    f-chain 0xfffff8008e620640 freemap.0   0000000000000010 0000000000000000/0  mir=0000000000
    000140
          [00002000] (?) refs=1
    ```
    
    Given that the memory leak has been fixed in commit
    bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
    now.
    
    ok by dillon.

Summary of changes:
 sys/vfs/hammer2/hammer2_vfsops.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/40e5c5625b097fde74fad7c8503aea083208630a


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:05 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:05 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 if_tun: Fix mbuf chain leak in tunwrite()
Message-ID: <20260902054905.F0B1332EB04E@crater.dragonflybsd.org>


commit 7e88ea5e3bc9753810b9ac173d9bfcd924bd46bd
Author: Nathan Sapwell <nathan at dreamfast.solutions>
Date:   Thu Jul 2 09:43:02 2026 +0000

    if_tun: Fix mbuf chain leak in tunwrite()
    
    tunwrite() builds an mbuf chain headed by 'top' in its read loop;
    on the final iteration the local 'm' points at the chain tail.
    Then the subsequent EAFNOSUPPORT default case of the family switch calls
    m_freem(m), freeing only that tail mbuf and leaking the chain head and
    all intermediates.
    
    Fix the m_freem() to free from 'top' instead to free the whole mbuf
    chain, matching the earlier error path.
    
    While there, fix one indentation. (aly)
    
    GitHub-PR: #39
    Assisted-with: Zhipu GLM-5.2

Summary of changes:
 sys/net/tun/if_tun.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7e88ea5e3bc9753810b9ac173d9bfcd924bd46bd


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kernel: Remove DIOCGSLICEINFO and
 DIOCSYNCSLICEINFO ioctls
Message-ID: <20260902054906.2375832EB050@crater.dragonflybsd.org>


commit 19c2bccad550a1453bc24bf0dec74384d7e7c870
Author: Aaron LI <aly at aaronly.me>
Date:   Wed Jul 22 21:32:27 2026 +0800

    kernel: Remove DIOCGSLICEINFO and DIOCSYNCSLICEINFO ioctls
    
    The DIOCGSLICEINFO ioctl code had a buffer overflow bug.  The ioctl
    declared the parameter to have size of 'struct diskslices', which only
    supported MAX_SLICES (i.e., 16) slices.  When try to use this ioctl on a
    disk with more slices (e.g., a GPT disk that may have 128
    partitions/slices), the bcopy() would overflow the target buffer that
    was prepared by mapped_ioctl().
    
    It's actually not easy to properly fix this bug. However, this ioctl was
    actually unused. In addition, FreeBSD has removed it in 2003 [1]. So
    simply remove it, together with the related DIOCSYNCSLICEINFO.
    
    [1] https://github.com/freebsd/freebsd-src/commit/19f7043db0bba9dd2c333612eff90411339d46de
    
    GitHub-PR: #43
    Reported-by: Nathan Sapwell (jewbird)
    Discussed-with: swildner

Summary of changes:
 sys/kern/subr_diskslice.c | 35 -----------------------------------
 sys/sys/diskslice.h       |  4 ++--
 sys/sys/param.h           |  2 +-
 3 files changed, 3 insertions(+), 38 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/19c2bccad550a1453bc24bf0dec74384d7e7c870


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kernel/linker: preserve refs after unload
 veto
Message-ID: <20260902054906.3CBAF32EB057@crater.dragonflybsd.org>


commit e6c9b951fe0ab738086c0471c41dc87d991c9b3b
Author: Leding Li <lileding at gmail.com>
Date:   Sat Jul 11 04:23:34 2026 +0800

    kernel/linker: preserve refs after unload veto
    
    linker_file_unload() used to take a temporary file reference (file->refs)
    before notifying modules to unload [1].  Its veto path dropped that
    temporary reference before returning the error.
    
    The 2009 linker code sync with FreeBSD [2] removed the temporary
    reference but retained the decrement.  Therefore, every failed kldunload
    reduced 'file->refs' even though the file remained loaded, allowing
    repeated EBUSY returns to drive the count below zero.
    
    Keep the existing reference when a module vetoes unload.  sys_kldunload()
    already restores userrefs on error, and a later unload attempt can retry
    with both counters unchanged.
    
    [1] Handle recursive situations a bit more robustly ...
        commit e7a2d40362352344eff1c4f395caf0a735e00a3e
    [2] modules: pull in most of FreeBSD's module linker changes
        commit 1c0e32863e0583221e430c22c1c68a023fd16195
    
    GitHub-PR: #50

Summary of changes:
 sys/kern/kern_linker.c | 1 -
 1 file changed, 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/e6c9b951fe0ab738086c0471c41dc87d991c9b3b


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kernel/linker: serialize recursive unload
Message-ID: <20260902054906.576B432EB060@crater.dragonflybsd.org>


commit bfab99d1d02ad6aa681e5344a5f085afc3f6a170
Author: Leding Li <lileding at gmail.com>
Date:   Wed Jul 22 11:05:33 2026 +0800

    kernel/linker: serialize recursive unload
    
    Restore the safe list traversal from commit
    e7a2d40362352344eff1c4f395caf0a735e00a3e.
    
    'llf_lock' is now recursive and held through the unload path, so
    callbacks and dependency release can recurse without exposing a
    partially unloaded file.
    
    GitHub-PR: #50

Summary of changes:
 sys/kern/kern_linker.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/bfab99d1d02ad6aa681e5344a5f085afc3f6a170


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 rpcinfo(8): Fix stack buffer overflow in
 rpcbaddrlist()
Message-ID: <20260902054906.702AE32EB064@crater.dragonflybsd.org>


commit f7502a8d6016aa962a5649e80978367d4e714c47
Author: Aaron LI <aly at aaronly.me>
Date:   Sat Jul 25 12:16:42 2026 +0800

    rpcinfo(8): Fix stack buffer overflow in rpcbaddrlist()
    
    rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR
    strings into a fixed 128-byte stack buffer with sprintf(). A malicious
    or on-path rpcbind server overflows it when a user runs:
    $ rpcinfo -l <host> <prognum> <versnum>
    
    Obtained-from: https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d
    CVE: CVE-2026-16277
    Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
    	(https://www.openwall.com/lists/oss-security/2026/07/23/8)

Summary of changes:
 usr.bin/rpcinfo/rpcinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/f7502a8d6016aa962a5649e80978367d4e714c47


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 rpcinfo(8): Fix stack buffer overflow in
 rpcbdump()
Message-ID: <20260902054906.87F6032EB067@crater.dragonflybsd.org>


commit a7cf60f09a62e4cf7e79dae90e9526ef3a27c5bd
Author: Aaron LI <aly at aaronly.me>
Date:   Sat Jul 25 12:56:53 2026 +0800

    rpcinfo(8): Fix stack buffer overflow in rpcbdump()
    
    The function previously used unbounded sprintf() and strcat() to format
    the info into a fixed 256-byte stack buffer.  A malicious or compromised
    rpcbind endpoint that returns enough distinct version numbers for a
    single program (roughly 24 maximum-width decimal values plus separators)
    can overflow this buffer.
    
    CVE: CVE-2026-16461
    Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
    	(https://www.openwall.com/lists/oss-security/2026/07/23/8)

Summary of changes:
 usr.bin/rpcinfo/rpcinfo.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a7cf60f09a62e4cf7e79dae90e9526ef3a27c5bd


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 vm: Remove duplicate reference in
 cdev_pager_allocate()
Message-ID: <20260902054906.A3B8132EB06A@crater.dragonflybsd.org>


commit 0118d2160c96337abca8e7abe4d16e7a2bc125f8
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Jul 28 19:11:38 2026 +0800

    vm: Remove duplicate reference in cdev_pager_allocate()
    
    The code was updated in 2013 [1] to bring in various changes from
    FreeBSD, but left this duplicate reference.  Remove the erroneous
    vm_object_reference_locked() call.
    
    [1] kernel: Port new device_pager interface from FreeBSD
        commit f2c2051ee473577d22178d55f782ceebbd88d58f
    
    GitHub-PR: #49
    Credit: LI Leding

Summary of changes:
 sys/vm/device_pager.c | 4 ----
 1 file changed, 4 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/0118d2160c96337abca8e7abe4d16e7a2bc125f8


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 jail: Fix potential buffer overflow in
 sysctl_jail_list()
Message-ID: <20260902054906.C942F32EB06E@crater.dragonflybsd.org>


commit d28806aee9f5dd8c0814019f3c284901c8b3280e
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 2 10:32:36 2026 +0800

    jail: Fix potential buffer overflow in sysctl_jail_list()
    
    sysctl_jail_list() allocates a buffer of size = count*1024, and then
    uses ksnprintf() to format the jail information and advance the write
    position. However, ksnprintf() returns the would-be length (i.e., the
    number of bytes would be written if the buffer is big enough). So a jail
    that has a very long path and/or many IPs would overflow the allocated
    buffer.
    
    Fix the bug by correctly handling the return value of ksnprintf().
    
    GitHub-PR: #45
    Reported-by: Nathan Sapwell (jewbird)

Summary of changes:
 sys/kern/kern_jail.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d28806aee9f5dd8c0814019f3c284901c8b3280e


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:06 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:06 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 mincore(2): Fix several bugs
Message-ID: <20260902054907.0A40932EB077@crater.dragonflybsd.org>


commit dfe3e28a544cb4775170f6cbc51841f8f3c8711e
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 3 09:55:07 2026 +0800

    mincore(2): Fix several bugs
    
    * Return ENOMEN when the requested range is not fully mapped.
      (obtained from FreeBSD: 455dd7d4c79bc7bef5401721f617e64eca7ef422)
    
      This change should fix a crash in Mesa where it calls mincore() to
      determine whether a protocol field is a valid pointer in order to
      keep compatible with an old protocol version.
    
    * Fix an off-by-one error in filling the skipped entries.  lastvecindex
      refers to the last valid byte, so the new bytes should come after it.
      (obtained from FreeBSD: 6a87d217e2da2a63d4431aeb871783e1dd7349ae)
    
    * Fix the calculation of the 'end' boundary.
      (obtained from FreeBSD: d0c9294b810f8b42b7ac27a46db44b94ddca3160)
    
    * Update the man page.
    
    Reported-by: peeterm

Summary of changes:
 lib/libc/sys/mincore.2 | 60 ++++++++++++++++++++++++++++++++++++++------------
 sys/vm/vm_mmap.c       | 42 +++++++++++++++++++++++------------
 2 files changed, 74 insertions(+), 28 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/dfe3e28a544cb4775170f6cbc51841f8f3c8711e


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 mincore(2): Add 'vm.mincore_mapped' sysctl
 to control reporting
Message-ID: <20260902054907.2420E32EB07A@crater.dragonflybsd.org>


commit bb51ebe099d2c1d752aeef88a1e6cb965d18f324
Author: Aaron LI <aly at aaronly.me>
Date:   Mon Aug 3 10:13:33 2026 +0800

    mincore(2): Add 'vm.mincore_mapped' sysctl to control reporting
    
    Add the 'vm.mincore_mapped' (default ON!) to control whether to report
    only the mapping status (if set to a non-zero value) or the physical
    residency (if set to a zero value; the old behavior).
    
    The idea of implementing this and enabling it by default is to help
    mitigate page cache attacks [1].
    
    [1] Page Cache Attacks: https://arxiv.org/abs/1901.01161
    
    Obtain-from: FreeBSD (https://reviews.freebsd.org/D18764)

Summary of changes:
 lib/libc/sys/mincore.2 | 19 ++++++++++++++++---
 sys/vm/vm_mmap.c       | 10 +++++++---
 2 files changed, 23 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/bb51ebe099d2c1d752aeef88a1e6cb965d18f324


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kernel: Fix two bugs in gptinit()
Message-ID: <20260902054907.3C9A432EB07D@crater.dragonflybsd.org>


commit d0146925e83b58154a5c70bfba689041aefbf43b
Author: Aaron LI <aly at aaronly.me>
Date:   Wed Aug 26 00:00:19 2026 +0800

    kernel: Fix two bugs in gptinit()
    
    * Fix the wrong type for 'table_lba'; should be 'uint64_t' instead of
      'uint32_t', and fix the read to use le64toh().
    
    * Allow the partition table has entries more than 128 (MAX_GPT_ENTRIES).
      The UEFI specification basically has no upper limit, but we limit to
      parsing the first 128 (MAX_GPT_ENTRIES) entries.
    
      This actually happens with a Proxmox v9.2 ISO, which uses GPT and
      allocates 44 blocks for the partition table, so there are 176 entries.
    
      For example, here is the gpt(8) of a USB stick written with this ISO:
    
      ```
      Disk da8: 57.3GB (120225792 512-byte sectors)
          Start    Sectors    Size  Index  Contents
              0          1    512B      -  PMBR
              1          1    512B      -  Primary GPT header
              2         18   9216B      -  Unused
             20         44  22.0KB      -  Primary GPT table
             64        560   280KB      0  GPT part - MS Basic Data
            624      16384  8192KB      1  GPT part - EFI System
          17008    3314724  1619MB      2  GPT part - Apple HFS+
        3331732        600   300KB      3  GPT part - MS Basic Data
        3332332          3   1536B      -  Unused
        3332335         44  22.0KB      -  Secondary GPT table
        3332379          1    512B      -  Secondary GPT header
        3332380  116893412  55.7GB      -  Unused
      ```
    
    Reported-by: swildner

Summary of changes:
 sys/kern/subr_diskgpt.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d0146925e83b58154a5c70bfba689041aefbf43b


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 binutils234: Patch readelf(1) to recognize
 DragonFly-specific notes
Message-ID: <20260902054907.54FA632EB099@crater.dragonflybsd.org>


commit 28b9924337571b2763283ee7e19ec28e48c81858
Author: Aaron LI <aly at aaronly.me>
Date:   Wed Aug 26 13:16:04 2026 +0800

    binutils234: Patch readelf(1) to recognize DragonFly-specific notes
    
    * Define NT_DRAGONFLY_ABI and NT_DRAGONFLY_NOINIT in
      'include/elf/common.h' according to 'lib/csu/common/notes.h'.
    * Add process_dragonfly_elf_note() to readelf.c to decode
      DragonFly-specific notes.
    
    Before:
    ```
    % readelf -n /bin/sh
    
    Displaying notes found in: .note.tag
      Owner                Data size        Description
      DragonFly            0x00000004       NT_VERSION (version)
       description data: c8 29 09 00
      DragonFly            0x00000004       Unknown note type: (0x00000020)
       description data: 00 00 00 00
    ```
    
    After:
    ```
    % readelf -n /bin/sh
    
    Displaying notes found in: .note.tag
      Owner                Data size        Description
      DragonFly            0x00000004       ABI (ABI version)
        ABI: 600520 (6.5.20)
      DragonFly            0x00000004       NOINIT (C runtime no init)
    ```

Summary of changes:
 contrib/binutils-2.34/README.DRAGONFLY     |  2 ++
 contrib/binutils-2.34/binutils/readelf.c   | 47 ++++++++++++++++++++++++++++++
 contrib/binutils-2.34/include/elf/common.h |  5 ++++
 3 files changed, 54 insertions(+)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/28b9924337571b2763283ee7e19ec28e48c81858


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 mpc: Fix inclusion paths to correctly
 include its own 'config.h'
Message-ID: <20260902054907.6BE3C32EB0A4@crater.dragonflybsd.org>


commit ff5e130671b7d236c7b50295ac269ae38365b275
Author: Aaron LI <aly at aaronly.me>
Date:   Fri Aug 28 12:57:43 2026 +0800

    mpc: Fix inclusion paths to correctly include its own 'config.h'
    
    It wrongly included the GMP's 'config.h', as the '../gmp/' directory has
    both 'gmp.h' and 'config.h'.

Summary of changes:
 gnu/usr.bin/mpc/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/ff5e130671b7d236c7b50295ac269ae38365b275


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 drm: Fix kobject_release() to free
 kobj->name
Message-ID: <20260902054907.836B532EB0AF@crater.dragonflybsd.org>


commit 57fb4c160e061af00758f3d8f8eaac96a16563c4
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 11:40:51 2026 +0800

    drm: Fix kobject_release() to free kobj->name
    
    While there, adjust kvasprintf() in kobject_init_and_add() to use
    'GFP_KERNEL' for consistency.

Summary of changes:
 sys/dev/drm/linux_kobject.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/57fb4c160e061af00758f3d8f8eaac96a16563c4


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kern: Clean up malloc_uninit()
Message-ID: <20260902054907.9BCA632EB0B2@crater.dragonflybsd.org>


commit 5531067a015b3d1d241cd24907f0d83d1940a148
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 30 13:07:29 2026 +0800

    kern: Clean up malloc_uninit()
    
    * Correct the diagnostic log message by omitting the CPU id, which
      doesn't apply here. The unfreed bytes must be summed from all CPUs.
    
    * Clean up excess INVARIANTS ifdef's by using '__debugvar' instead.

Summary of changes:
 sys/kern/kern_slaballoc.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5531067a015b3d1d241cd24907f0d83d1940a148


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 kern: Fix memory leak in
 kdmsg_iocom_uninit()
Message-ID: <20260902054907.B43C032EB0BE@crater.dragonflybsd.org>


commit b243cfc0beab210174dd322636534e26bd526ea1
Author: Antonio Huete Jimenez <tuxillo at quantumachine.net>
Date:   Fri Dec 19 00:56:11 2025 +0100

    kern: Fix memory leak in kdmsg_iocom_uninit()
    
    When kdmsg_iocom_uninit() is called but no connection was ever
    established (no reader/writer threads), a PING message was allocated and
    queued but never freed. This caused a 120-byte leak from the HAMMER2-msg
    allocator on shutdown.
    
    Fix this by calling kdmsg_drain_msgq() to clean up any queued messages.
    
    This fixes the 'malloc_uninit: 120 bytes of HAMMER2-msg still allocated'
    warning.  Note that this warning already disappeared after fixing the
    hammer2_ioctl_recluster() bug in commit
    c5cc81fefa166cc45657541c155797f0cff88c62.
    
    Bug: https://bugs.dragonflybsd.org/issues/3385

Summary of changes:
 sys/kern/kern_dmsg.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/b243cfc0beab210174dd322636534e26bd526ea1


-- 
DragonFly BSD source repository

From aly at crater.dragonflybsd.org  Tue Sep  1 22:49:07 2026
From: aly at crater.dragonflybsd.org (Aaron LI)
Date: Tue,  1 Sep 2026 22:49:07 -0700 (PDT)
Subject: git: DragonFly_RELEASE_6_4 hammer2: Disable debug v/f-chain dumps on
 unmounting
Message-ID: <20260902054907.CC64932EB0C8@crater.dragonflybsd.org>


commit b0913e31a6018341cfaee40200e3c21fa1001270
Author: Aaron LI <aly at aaronly.me>
Date:   Wed Sep 2 09:14:20 2026 +0800

    hammer2: Disable debug v/f-chain dumps on unmounting
    
    The two dumps were added to track down the HAMMER2-msg leak reported by
    malloc_uninit() and would always print the following logs at shutdown:
    
    ```
    v-chain 0xfffff8008e6204c0 volume.0   0000000000000010 0000000000000000/0  mir=00000000000
    00140
          [00002000] (?) refs=1
    f-chain 0xfffff8008e620640 freemap.0   0000000000000010 0000000000000000/0  mir=0000000000
    000140
          [00002000] (?) refs=1
    ```
    
    Given that the memory leak has been fixed in commit
    bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
    now.
    
    ok by dillon.

Summary of changes:
 sys/vfs/hammer2/hammer2_vfsops.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/b0913e31a6018341cfaee40200e3c21fa1001270


-- 
DragonFly BSD source repository