vmm: Emulate the byte forms of OR and AND with an immediate
Opcode 0x80 (group 1: r/m8, imm8) is in the decode table and
emulate_cmp() handles 80 /7, but emulate_or() and emulate_and() only
accept 0x81 and 0x83. An "or byte ptr [mem], imm8" or "and byte ptr
[mem], imm8" on emulated memory therefore fails with EINVAL and bhyve
stops the guest with "Failed to emulate instruction sequence
[ 80 ... ]". Seen with macOS: VoodooHDA starts the HDA controller's
CORB with "or byte [rax+0x4c], 2" (CORBCTL |= CORBRUN), and the guest
died at the first sound.
Accept 0x80 in both, with a one byte operand as emulate_cmp() does.
The file is shared with bhyve(8), so the fix covers the in-kernel
devices (HPET, local APIC without APICv, I/O APIC) and the user space
device models alike.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
[3 lines not shown]
link_elf_obj: guard reltab/relatab frees in link_elf_unload_file()
link_elf_unload_file() frees the per-section relocation tables by iterating
ef->nreltab / ef->nrelatab, but dereferences ef->reltab / ef->relatab
unconditionally. The counts are set while scanning the section headers, before
the tables are allocated, so an error on the load path reaches it with a
non-zero count and a NULL table, faulting on ef->relatab[0].rela. Reachable
from link_elf_load_file() once a valid relocation section has been counted,
e.g. a later section with sh_info >= e_shnum (D60937).
Guard the loops with the table pointer, as is already done for ef->progtab
above.
MFC after: 1 week
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D61140
link_elf_obj: bounds-check a relocation section's sh_info
sh_info is used to index the section header array without checking it
against e_shnum, so a malformed object can make the linker read out of
bounds. Reject such a file with ENOEXEC in both the preload and kldload
paths.
MFC after: 1 week
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D60937
gptzfsboot: Use snprintf() to format file names
The stack buffer in fs_list() can be overflowed if a file name is too
long.
Reported by: Yudi Yang <yudi.yang at rice.edu>
MFC after: 1 week
x11/tabby: Add New Port
Tabby is a terminal emulator with integrated SSH, Telnet and serial
clients. It keeps tabs and split panes in persistent layouts, stores
connection profiles in an encrypted vault and can be extended through
plugins.
www: https://tabby.sh/
Sponsored by: Netzkommune GmbH
Pin dedup off on internal datasets
## Problem
Dedup can be enabled on the pool root dataset, either at pool creation or later, and the internal `.system` and `.truenas_containers` trees inherit it, so system dataset and container writes go through the dedup table. ix-apps already pins `dedup=off`, but its drift check compares raw values only, so an ix-apps tree created before that pin and inheriting `off` is never pinned locally and would follow the root once it is switched on.
## Solution
Rather than refusing dedup on the root, which is a supported pool.create workflow, the internal trees now carry a local `dedup=off`:
- **System dataset**: `.system` is created with `dedup=off` (children inherit it), and `setup_datasets` re-pins dedup whenever its source is not local, so existing systems get pinned on the next boot/import/failover reconcile.
- **Containers**: `.truenas_containers` is created with `dedup=off`, and an existing tree is re-pinned when datasets are ensured (create/pull/migrate) and on container start, which also covers boot autostart and failover.
- **ix-apps**: the drift check also fires when dedup is not set locally.
Blocks that were already written deduplicated stay in the dedup table until rewritten; only new writes are affected.
libtatsu: update to 1.1.0.
Version 1.1.0
~~~~~~~~~~~~~
Changes:
- Add tss_request_add_bora_tags() and tss_request_add_durant_tags() to the API
- Update auth client version and add Ap,Timestamp to requests
- Restrict Yonkers tag selection to SysTopPatch
Fixes:
- Handle realloc() failure in tss_write_callback()
devel/ruby-activesupport81: add version 8.1.4.1
Active Support -- Utility classes and Ruby extensions from Rails
Active Support is a collection of utility classes and standard library
extensions that were found useful for the Rails framework. These additions
reside in this package so they can be loaded as needed in Ruby projects
outside of Rails.
This is for Ruby on Rails 8.1.
libplist: update to 2.8.1.
Version 2.8.1
~~~~~~~~~~~~~
- Changes:
* bplist: Use length-based range checks for object data
* bplist: Limit the total number of parsed nodes to prevent memory
exhaustion from crafted reference expansion
* bytearray: Grow the buffer geometrically to avoid quadratic appends
(fixes a timeout when writing large plists)
* Harden allocation failure handling and size arithmetic across the
parsers, writers and containers
* Add tests for the binary plist parser behavior
- Bugfixes:
* Fix use-after-free in plist_copy_node() when the stack is reallocated
* Fix double-free in node_from_xml() error paths
* Fix memory leak in xplist when adding a node to its parent fails
[12 lines not shown]
inih: update to 63.
This release fixes a few minor bugs, adds two new minor features:
exposes INI_MAX_SECTION and INI_MAX_NAME as "public settings, and
adds a new error code (-3) for file read errors.
fzf: update to 0.75.0.
Added {change,transform,bg-transform}-info-command actions (#4951) (@casperdcl)
seq 100 | fzf --info-command 'echo "mode: A | $FZF_INFO"' \
--bind 'ctrl-a:change-info-command:echo "mode: A | $FZF_INFO"' \
--bind 'ctrl-b:change-info-command:echo "mode: B | $FZF_INFO"'
transform-nth and transform-with-nth (and their bg- variants) no longer split the output at |
Only change-nth and change-with-nth rotate through |-separated values
Fixed the bound command being replaced with the output. e.g. With transform-nth(echo '1|2'), the next key press ran 2|1 as a shell command.
A --with-nth template in the output can now contain |. e.g. {2}|{1} was cut to {2}.
change-nth and transform-nth now handle empty and invalid values the same way as change-with-nth and transform-with-nth
An empty value restores the default --nth. Previously, change-nth() and an empty transform-nth output searched all fields. Use change-nth(..) for that.
A non-empty invalid value is ignored. Previously, it restored the default --nth.
[33 lines not shown]
