Split CSR profiles by certificate role
This commit adds changes to replace the two HTTPS CSR profiles with four role specific ones covering TLS server and TLS client use, in both RSA and EC. Both old profiles asked for SERVER_AUTH and CLIENT_AUTH together, which Google Trust Services now rejects outright with badCSR. Once you can no longer name both purposes in one request, a single shape stops serving both roles, since a certificate is only usable for the purposes its extended key usage names.
The server profiles now request SERVER_AUTH alone, which is what Google and the Chrome root programme want by 2027 and what relying parties like Apple expect to find on a TLS server certificate, and the client profiles request CLIENT_AUTH so mutual TLS against syslog, LDAP and KMIP has something usable. This also drops the RSA keyAgreement bit the baseline requirements forbid, makes the EKU non critical, and removes the dead lifetime key that certificate.create would have rejected. The catalogue is declared in v26 and v27 both, since v26 is the current version on the stable branch, so backporting means keeping the v26 hunk and omitting the v27 one; to_previous on v26 is what keeps older API clients on the profiles they already know.
[MISched] Apply debug filters before starting a block (#222270)
Apply the `misched-only-func` and `misched-only-block` filters before
calling `startBlock`. This avoids entering a target scheduling strategy
for a filtered block without a matching `finishBlock`/`leaveMBB` call.
Add a SystemZ post-RA scheduler regression that checks a filtered block
does not contribute hazard-recognizer state.
Split from #221984 in response to review.
[Flang][OpenMP] Add lowering and translation for the threadset clause (#215513)
Adds Flang lowering, and LLVM IR translation for the OpenMP 6.0 `threadset` clause (spec 14.8) on `task` and `taskloop`.
- Add a `ThreadsetPolicy` enum (`omp_pool`/`omp_team`) and clause on `omp.task` and `omp.taskloop.context`, lowered from Flang.
- Translate `threadset(omp_pool)` to the free-agent task flag (`0x80`); `omp_team` leaves it unset, matching clang.
- Add semantics, lowering, and translation tests.
Related: https://github.com/llvm/llvm-project/pull/135807,https://github.com/llvm/llvm-project/pull/144409,https://github.com/llvm/llvm-project/pull/169856
[RISCV] Fix infinite DAGCombine loop with SETCC and SIGN_EXTEND_INREG (#221593)
We generalized (X & -(1 << C1) & 0xffffffff) == C2 << C1 using `sraiw`.
The combine generates a `SIGN_EXTEND_INREG` when simplifying.
However, when C1 is 0 and the sign bit (bit 31) of X is already known to
be zero, `DAGCombiner` sees that `SIGN_EXTEND_INREG` is semantically
equivalent to `AND X, 0xFFFFFFFF` (zext). Because `DAGCombiner`
considers `AND` to be more canonical than `SIGN_EXTEND_INREG` in this
context, it immediately reverts the node back to `AND`.
This caused an infinite DAGCombine loop. This patch disables the folding
when the C1 is zero. That case is covered by a later combine that already
checks if bit 31 is known to be zero.
Fixes: https://github.com/llvm/llvm-project/issues/221521
(cherry picked from commit f9a8dec9496fea7c55f591a66a64dbcdc085fc2d)
[CodeGen] Skip pseudo instructions in AggressiveAntiDepBreaker (#222271)
`ScheduleDAGInstrs` does not create SUnits for debug or pseudo
instructions. The aggressive anti-dependency breaker only skipped debug
instructions, so encountering a pseudo such as `PSEUDO_PROBE`
dereferenced a null SUnit.
Skip both debug and pseudo instructions and add a Hexagon regression
covering the existing aggressive anti-dependency path with legacy and
new machine pass managers.
Split from #221984 in response to review.
Gate S3 auditing on appliance hardware
This commit adds changes to decide whether the S3 service audits requests from the hardware class rather than from the license, so it matches the gate the kernel audit handler already uses -- both halves of the audit trail land in the same database, so both have to answer to the same thing. The check is renamed audit_supported since it no longer reads a license, and the validation messages and API field descriptions say appliance hardware instead of Enterprise license.
[clang-tidy] Normalize windows line filter paths (#217038)
`git | clang-tidy-diff.py` emits line-filter paths with forward slashes,
while Windows compilation databases use a mix of forwards and backwards
slashes. These paths are then silently rejected (and no report is
emitted).
Reproduce on windows via:
```
git.exe diff -U0 main -- . | python clang-tidy-diff.py -p1 -path .\build"
```
Git will produce a path like:
```
my/source/file.cpp
```
The compilation database has files with entries like this:
```
[18 lines not shown]
[Clang] Avoid unnecessary overload resolution when building RecoveryExpr (#222296)
When overload resolution fails, we tried RecoveryCallExpr which
ended up performing duplicate overload resolutions, where the template
argument deduction can be expensive.
This patch removes those 'known' invalid overload candidates before
RecoveryCallExpr.
[CIR] Add offload container attribute (#206576)
Introduce `cir.offload.container`, a CIR dialect unit attribute that marks an
MLIR module as holding a host CIR module and its associated device CIR
modules in one IR unit while later offload merge/split pipeline passes need
visibility into both sides.
The marked module's body holds nested `builtin.module` operations. Each
nested module is tagged with `cir.offload.kind`, represented by the new
`#cir.offload_kind<host>` / `#cir.offload_kind<device>` enum attribute.
The structural contract expected by the follow-up pipeline work is
enforced in `CIRDialect::verifyOperationAttribute`, following the
`gpu.container_module` precedent:
* `cir.offload.container` is a unit attribute attached to a
`builtin.module`
* the first nested module is the host module
* all following nested modules are device modules
[10 lines not shown]
[Driver][OpenBSD] Use -no-pie instead of -nopie (#220464)
Downstream in OpenBSD there is a patch to add support for -nopie in lld
(which it has used by default since 2018). In this repo lld does not
support `-nopie`, so when building clang and lld, you cannot link an
executable with `clang -fno-pic`. Clang now uses the more widely used
spelling here so that toolchains built from this repo can cross compile
to OpenBSD successfully.
This change is an issue on OpenBSD if users passed a different linker
with `-fuse-ld` / `--ld-path` to `ld.bfd` which is still installed by
default but doesn't support the `-no-pie` spelling with their patches.
(cherry picked from commit a2171756dd5d690faf30bafe63810d1dc6cdb342)
[Driver][OpenBSD] Pass -pie for static PIE links (#216907)
OpenBSD uses `rcrt0.o` for static PIE executables. This startup object
references the linker-defined `_DYNAMIC` symbol.
OpenBSD's system linker defaults to PIE, which previously masked the
missing driver flag. An LLD cross-linker built on a non-OpenBSD host
does not share that default. Consequently,
`clang --target=...-openbsd -static` selects `rcrt0.o`, but LLD does not
create `_DYNAMIC`, causing the link to fail.
(cherry picked from commit 118efe7680bdc010ab984f8ae4505699f53bbca6)
[AMDGPU] Add missing attributes to llvm.amdgcn.init.whole.wave (#222493)
`llvm.amdgcn.init.whole.wave` only sets the EXEC mask and reports
whether the lane was active on entry. It never calls into the module,
never frees memory, and always returns, so it can carry `nocallback`,
`nofree`, and `willreturn`.
The neighboring `llvm.amdgcn.init.exec` and
`llvm.amdgcn.init.exec.from.input` already have all three; this brings
`init.whole.wave` in line and lets the attributor propagate them to
callers.
[GitHub] Bump CI Container Runner Version to 2.337.0 (#222480)
This is the latest version and keeps us ahead of the relatively short
runner support horizon.
MFC: fsck_msdosfs: add a test for reconnecting on volumes larger than 4 GiB
MFC after: 1 week
(cherry picked from commit 37aec55d0a7165960f686e5277f030ab3d44cf45)
