LLVM/project 0c62d83llvm/lib/Transforms/Vectorize VPlan.cpp VPlanUtils.cpp

[VPlan] Record estimated branch probabilities on VPlan0 for cost modeling (#216172)

Update execution frequency/probability tracking in VPlan to also include
estimates from BFI, and use the information in VPlan for VPlan-based
cost computations, removing another remaining IR-based lookup.

We need to differentiate between estimated and concrete profile
information when annotating branches with information from BFI (using
custom !vplan.prof.estimated metadata instead of !prof) and track if a
computed frequency contains any estimates using an extra bool which is
also encoded in the metadata (so we do not synthesize !prof
for such frequencies during codegen).

The new code should only request BFI if needed, and compile-time impact
should be in the noise:

https://llvm-compile-time-tracker.com/compare.php?from=8436dd4a2bfe57d0b3fb6c9c11c69d75c1d1bccb&to=4d60694fed5e5765d4f5a2a72aac7b8674e512e2&stat=instructions:u

PR: https://github.com/llvm/llvm-project/pull/216172
DeltaFile
+33-25llvm/lib/Transforms/Vectorize/VPlanRecipes.cpp
+41-9llvm/lib/Transforms/Vectorize/VPlanConstruction.cpp
+43-3llvm/lib/Transforms/Vectorize/VPlan.h
+24-16llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+18-11llvm/lib/Transforms/Vectorize/VPlanUtils.cpp
+15-0llvm/lib/Transforms/Vectorize/VPlan.cpp
+174-6411 files not shown
+227-9217 files

LLVM/project 4b8b168llvm/lib/Target/AMDGPU SIISelLowering.cpp, llvm/test/CodeGen/AMDGPU read-register-src-flat-scratch-base.ll write-register-src-flat-scratch-base.ll

[AMDGPU] Add getRegisterByName support for src_flat_scratch_base (#220560)

Expose `src_flat_scratch_base`, `src_flat_scratch_base_lo`, and
`src_flat_scratch_base_hi` through `llvm.read_register` /
`llvm.write_register`.

The implementation is basically the same as the existing named-register
support for `flat_scratch`

It errors out on targets without `FeatureGloballyAddressableScratch`
(pre-gfx1250).
DeltaFile
+92-0llvm/test/CodeGen/AMDGPU/type-mismatch-src-flat-scratch-base.ll
+52-0llvm/test/CodeGen/AMDGPU/read-write-register-src-flat-scratch-base-invalid-subtarget.ll
+38-0llvm/test/CodeGen/AMDGPU/write-register-src-flat-scratch-base.ll
+35-0llvm/test/CodeGen/AMDGPU/read-register-src-flat-scratch-base.ll
+23-9llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+240-95 files

LLVM/project d6a334dllvm/lib/Target/AMDGPU/AsmParser AMDGPUAsmParser.cpp, llvm/test/MC/AMDGPU buffer-op-lds-operand.s

[AMDGPU][AsmParser]: Use dummy operand for parsing buffer LDS isAsync… (#219459)

… operand.

After the introduction of .async for LDS buffer ops variants, there a
similar mca crash addressed in
https://github.com/llvm/llvm-project/pull/165305. This parses a dummy
operand as a placeholder.
DeltaFile
+51-0llvm/test/tools/llvm-mca/AMDGPU/buffer-op-lds-operand.s
+29-0llvm/test/MC/AMDGPU/buffer-op-lds-operand.s
+4-0llvm/lib/Target/AMDGPU/AsmParser/AMDGPUAsmParser.cpp
+84-03 files

LLVM/project cd2f665llvm/include/llvm/CodeGen/GlobalISel GISelWorkList.h

[GlobalISel] Lazily reserve worklist maps (NFC) (#221900)

Small -0.03% geomean improvement on CTMark aarch64-O0-g, but consistent
little improvements across the board.

https://llvm-compile-time-tracker.com/compare.php?from=97cbc1e404b980edc58bfbcabb6f1c61793b624b&to=1729db67721b79fcb72469111d543e6df28c1185&stat=instructions:u

Assisted-by: codex
DeltaFile
+2-4llvm/include/llvm/CodeGen/GlobalISel/GISelWorkList.h
+2-41 files

LLVM/project 9a14832llvm/lib/Target/AMDGPU SIInstrInfo.cpp

[AMDGPU] Check a wide copy dst reg against the dst operand's regclass (#221789)

The wide-copy check added in #214561 tested the destination against the
source operand's class. No test change: V_MOV_B64's source class VS_64
also accepts a VGPR destination, which is why it currently works. Adding
@robertvirany.

Co-authored-by: Claude <noreply at anthropic.com>
DeltaFile
+7-5llvm/lib/Target/AMDGPU/SIInstrInfo.cpp
+7-51 files

LLVM/project 411a8eeopenmp/runtime/src kmp_settings.cpp kmp_traits.h, openmp/runtime/src/i18n en_US.txt

[libomp] Parse OMP_DEFAULT_DEVICE with new device trait parser (#176166)

... but do not yet expose the new functionalities to the user. This is a
backward compatible update that is going to be followed by the step to
the OpenMP 6.0 semantics as defined in 4.3.8.
DeltaFile
+105-0openmp/runtime/unittests/Traits/TestOMPTraitParser.cpp
+24-0openmp/runtime/src/kmp_traits.cpp
+8-0openmp/runtime/src/kmp_traits.h
+3-2openmp/runtime/src/kmp_settings.cpp
+3-0openmp/runtime/src/i18n/en_US.txt
+143-25 files

LLVM/project f42f403clang/test/Frontend optimization-remark-target-features-arm.c optimization-remark-target-features-aarch64.c, llvm/lib/CodeGen/AsmPrinter AsmPrinter.cpp

[AsmPrinter] target-features optimization remarks

In clang we have --print-enabled-extensions which will print the
AArch64 extensions enabled for a given TU. However, sometimes it is
useful to be able to print out the actual subtarget features for each
function, for debugging/testing purposes. Add an optimization remark
for that.
DeltaFile
+45-0llvm/test/CodeGen/AArch64/optimization-remark-target-features.ll
+30-0clang/test/Frontend/optimization-remark-target-features-aarch64.c
+30-0llvm/test/CodeGen/ARM/optimization-remark-target-features.ll
+19-0clang/test/Frontend/optimization-remark-target-features-arm.c
+17-0llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
+141-05 files

LLVM/project 68a77b6clang/lib/CIR/CodeGen CIRGenBuiltinAMDGPU.cpp, clang/test/CIR/CodeGenHIP builtins-amdgcn-wave32.hip builtins-amdgcn-wave64.hip

[CIR][AMDGPU] Implement inverse_ballot and read_exec codegen (#221661)

This commit implements the CIR codegen for the following AMDGPU
builtins:
- __builtin_amdgcn_inverse_ballot_w32
- __builtin_amdgcn_inverse_ballot_w64
- __builtin_amdgcn_read_exec
- __builtin_amdgcn_read_exec_lo
- __builtin_amdgcn_read_exec_hi

inverse_ballot_w32/w64 map to llvm.amdgcn.inverse.ballot. read_exec,
read_exec_lo and read_exec_hi read the exec mask as a ballot over an
all-true predicate, at least as wide as the wavefront.
DeltaFile
+42-0clang/test/CIR/CodeGenHIP/builtins-amdgcn-wave64.hip
+40-0clang/test/CIR/CodeGenHIP/builtins-amdgcn-wave32.hip
+21-10clang/lib/CIR/CodeGen/CIRGenBuiltinAMDGPU.cpp
+103-103 files

FreeBSD/ports f1c5375audio/waves Makefile distinfo

audio/waves: Update to 0.1.49

ChangeLog:

1. https://github.com/llehouerou/waves/releases/tag/v0.1.49

Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+5-5audio/waves/distinfo
+1-1audio/waves/Makefile
+6-62 files

LLVM/project f796b25llvm/lib/Target/Mips MipsAsmPrinter.h MipsAsmPrinter.cpp, llvm/test/CodeGen/Mips jalr-no-mangle.ll

[Mips] Strip \x01 no-mangle prefix from R_MIPS_JALR symbol name (#219427)

R_MIPS_JALR relocation did not strip the \x01 no-mangle prefix, causing
linker to see two different symbols: my_target_sym and
\x01my_target_sym.

Use Mangler::getNameWithPrefix() to process the symbol name.

Fix #207470.
DeltaFile
+30-0llvm/test/CodeGen/Mips/jalr-no-mangle.ll
+7-7llvm/lib/Target/Mips/MipsAsmPrinter.cpp
+3-0llvm/lib/Target/Mips/MipsAsmPrinter.h
+40-73 files

FreeBSD/ports b086623devel/py-virtualenv distinfo Makefile

devel/py-virtualenv: Update to 21.7.9

- Disable test target due to the following startup error:

pluggy._manager.PluginValidationError: Plugin 'black' for hook 'pytest_collect_file'
hookimpl definition: pytest_collect_file(file_path, path, parent)
Argument(s) {'path'} are declared in the hookimpl but can not be found in the hookspec

See https://github.com/pytest-dev/pytest/issues/14651

- Pet portfmt

ChangeLog:      https://github.com/pypa/virtualenv/releases/tag/21.7.9

Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+8-4devel/py-virtualenv/Makefile
+3-3devel/py-virtualenv/distinfo
+11-72 files

LLVM/project 1c21c5fllvm/test/CodeGen/AArch64 arm64-abi_align.ll, llvm/test/CodeGen/Hexagon/vect vect-xor.ll vect-v4i16.ll

llvm: Remove phantom ssp-buffers-size attributes from tests

"ssp-buffers-size" was never a real function attribute. There is
"stack-protector-buffer-size". This may have existed in a downstream
fork, but it's also irrelevant for these tests.

Co-authored-by: Claude (Claude-Opus-4.8) <noreply at anthropic.com>
DeltaFile
+4-4llvm/test/CodeGen/AArch64/arm64-abi_align.ll
+2-2llvm/test/Transforms/SimplifyCFG/volatile-phioper.ll
+1-1llvm/test/Transforms/LoopVectorize/vectorize-once.ll
+1-1llvm/test/Transforms/LoopVectorize/dbg.value.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-xor.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-v4i16.ll
+10-102 files not shown
+12-128 files

LLVM/project 6390ccdllvm/test/CodeGen/AArch64 arm64-abi_align.ll, llvm/test/CodeGen/Hexagon/vect vect-xor.ll vect-v4i16.ll

llvm: Remove phantom relocation-model attributes from tests

"relocation-model" was never a real function attribute.

Co-authored-by: Claude (Claude-Opus-4.8) <noreply at anthropic.com>
DeltaFile
+4-4llvm/test/CodeGen/AArch64/arm64-abi_align.ll
+2-2llvm/test/Transforms/SimplifyCFG/volatile-phioper.ll
+1-1llvm/test/Transforms/LoopVectorize/vectorize-once.ll
+1-1llvm/test/Transforms/LoopVectorize/dbg.value.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-xor.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-v4i16.ll
+10-102 files not shown
+12-128 files

LLVM/project 39ffb93llvm/test/CodeGen/AArch64 arm64-abi_align.ll, llvm/test/CodeGen/Hexagon/vect vect-xor.ll vect-v4i16.ll

llvm: Remove phantom fp-contract-model attributes from tests (#221925)

This attribute has never been consumed by upstream llvm,
or emitted by upstream clang. I can only guess this existed in
at least one downstream fork.
DeltaFile
+4-4llvm/test/CodeGen/AArch64/arm64-abi_align.ll
+2-2llvm/test/Transforms/SimplifyCFG/volatile-phioper.ll
+1-1llvm/test/Transforms/LoopVectorize/vectorize-once.ll
+1-1llvm/test/Transforms/LoopVectorize/dbg.value.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-xor.ll
+1-1llvm/test/CodeGen/Hexagon/vect/vect-v4i16.ll
+10-102 files not shown
+12-128 files

OpenBSD/src q3wrp4Jusr.bin/tmux layout-custom.c

   Add a nesting limit for v1 layouts, reported by M Khalilov, fix based on
   issue 5572 from Afonso Januário. Also tweak some language while here.
VersionDeltaFile
1.41+16-9usr.bin/tmux/layout-custom.c
+16-91 files

FreeBSD/src 6af3031sys/dev/tpm tpm_crb.c

tpm: crb: make the Pluton startmethod more resilient

The original implementation assumed that the start/reply doorbells
lived within the device _CRS space, but that isn't always the case.  On
my AMD Ryzen 7640U-based frame.work laptop, device memory runs from
0xc0500000-0xc0500fff while the doorbells are up around 0xc0508000.

Stop sanity checking the addresses and just map them in to work reliably
whether they're within the device range or not.

pluton_wait_reply is cribbed from tpm_wait_for_u32, but rewritten
slightly to read in just one place and to read one last time before
giving up at the end of the timeout, just in case.

Reviewed by:    kbowling
Differential Revision:  https://reviews.freebsd.org/D59327
DeltaFile
+88-29sys/dev/tpm/tpm_crb.c
+88-291 files

LLVM/project 1770693llvm/lib/Transforms/Vectorize VPlanRecipes.cpp

[VPlan] Add scalar-type-infer assert for casts (NFC) (#222258)

Casts require the ResultTy to be passed: add an assert to
computeScalarTypeForInstruction to guard against incorrect usage.
DeltaFile
+2-0llvm/lib/Transforms/Vectorize/VPlanRecipes.cpp
+2-01 files

LLVM/project cdab5d7llvm/docs AMDGPUUsage.rst, llvm/lib/Target/AMDGPU AMDGPUMemoryUtils.cpp SIDefines.h

[AMDGPU] Add synthetic apertures and use them for barriers (#209748)

Define what a synthetic aperture is, and adjust the barrier AS
to use this new system. This makes the barrier AS even safer to
use as now we can use all 32 bits of it without ever risking
hitting a valid address of any kind (LDS or outside LDS).
DeltaFile
+73-90llvm/test/CodeGen/AMDGPU/addrspacecast-barrier.ll
+51-5llvm/docs/AMDGPUUsage.rst
+21-23llvm/lib/Target/AMDGPU/AMDGPULegalizerInfo.cpp
+18-17llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+13-0llvm/lib/Target/AMDGPU/SIDefines.h
+9-0llvm/lib/Target/AMDGPU/AMDGPUMemoryUtils.cpp
+185-1354 files not shown
+195-14010 files

FreeBSD/ports 66cd9a0net-mgmt/telegraf Makefile

net-mgmt/telegraf: Build with go 1.27 as required

Reported by:    olgeni@
DeltaFile
+2-1net-mgmt/telegraf/Makefile
+2-11 files

LLVM/project 59c5d5ellvm/lib/Target/X86 X86ISelLowering.h X86ISelLowering.cpp, llvm/test/CodeGen/X86 branch-on-zero.ll

[X86] Enable preferZeroCompareBranch() (#219919)

This makes CodeGenPrepare reorganize code such as:

```
%c = icmp eq i32 %x, 10
br %c, then, else
%a = add i32 %x, -10
```

into

```
%a = add i32 %x, -10
%cmp = icmp eq %a, 0
%br %cmp, then, else
```

so that the zero-compare and branch gets lowered to a JCC based on the

    [3 lines not shown]
DeltaFile
+601-0llvm/test/CodeGen/X86/branch-on-zero.ll
+2-0llvm/lib/Target/X86/X86ISelLowering.h
+2-0llvm/lib/Target/X86/X86ISelLowering.cpp
+605-03 files

FreeBSD/src 74c5995usr.sbin/syslogd/tests syslogd_test.sh

syslogd/tests: Amend a test to catch leaked process descriptors

This serves to catch the regression fixed by commit
1a669b66ddb4 ("syslogd: reap pipe children on config reload").

MFC after:      1 week

(cherry picked from commit 231dfc99a08874c269593c2e491ce16a618f4ed6)
DeltaFile
+7-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-01 files

FreeBSD/src 266331csys/netpfil/pf pf_lb.c pf.c

pf: Re-optimize state key handling

pf states may be looked up using one of two keys: the stack key or the
wire key.  For states involving address translation, these will be
distinct; the stack key describes the addresses seen by the local
network stack, and the wire key has the translated addresses.

Historically, pf would avoid allocating separate keys if both are
identical.  This changed in commit fcdb520c1b4e ("pf: nat64") to always
allocate separate state key structures.  Incidentally, OpenBSD seems to
maintain the optimization, but also has an explicit reference count
embedded in state keys.

The change breaks another optimization: pf_state_key_attach() still uses
state key pointer equality to check whether the stack and wire keys are
equal, so those checks are always false after the aforementioned commit.
Thus we never skip the second key lookup, even when that's possible
(i.e., no address translation is involved).


    [15 lines not shown]
DeltaFile
+15-10sys/netpfil/pf/pf.c
+10-1sys/netpfil/pf/pf_lb.c
+25-112 files

FreeBSD/src 8cf0058usr.sbin/syslogd syslogd.c

syslogd: reap pipe children on config reload

On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running.  close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue.  When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.

Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.

Reviewed by:    markj
Fixes:  95381c0139d6 (syslogd: Use process descriptors)
Differential Revision:  https://reviews.freebsd.org/D59319

(cherry picked from commit 1a669b66ddb4748c24116e32dcb51eabaf4859ed)
DeltaFile
+9-5usr.sbin/syslogd/syslogd.c
+9-51 files

OpenBSD/src Z1k2Xjpusr.bin/tmux screen-redraw.c

   Draw bottom border with pane status line at the top.
VersionDeltaFile
1.159+2-2usr.bin/tmux/screen-redraw.c
+2-21 files

LLVM/project 5bf967cllvm/lib/Target/AMDGPU SIISelLowering.cpp, llvm/test/CodeGen/AMDGPU amdgpu-lower-exec-sync.ll amdgpu-lower-exec-sync-and-module-lds.ll

[RFC][AMDGPU] Add BARRIER address space (#209746)

Add a new BARRIER address space that is used for global variables that
are used to represent the barrier IDs in GFX12.5.

These barrier addresses just have values corresponding 1-1 to barrier
IDs. They are still implemented on top of LDS, but the offsetting
happens during an addrspacecast to generic, not whenever the barrier GV
is used.

The motivation for this is to make the relation between LDS and barrier
GVs explicit in the compiler. It does add a bit more complexity, but
that complexity was already there, just hidden by pretending barrier GVs
were actual LDS.
DeltaFile
+481-0llvm/test/CodeGen/AMDGPU/addrspacecast-barrier.ll
+85-76llvm/test/CodeGen/AMDGPU/s-barrier-signal-var-gep.ll
+72-61llvm/test/CodeGen/AMDGPU/s-barrier.ll
+59-43llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+32-32llvm/test/CodeGen/AMDGPU/amdgpu-lower-exec-sync.ll
+32-32llvm/test/CodeGen/AMDGPU/amdgpu-lower-exec-sync-and-module-lds.ll
+761-24453 files not shown
+1,289-58259 files

OpenBSD/src 7I6ymjLusr.bin/tmux tmux.h control.c

   Bound the memory used by buffered control mode command replies (to 64
   MB), GitHub issue 5565 from kagari dot shusei at proton dot me.
VersionDeltaFile
1.68+53-2usr.bin/tmux/control.c
1.1438+2-1usr.bin/tmux/tmux.h
+55-32 files

FreeNAS/freenas 6b83874src/middlewared/middlewared/plugins/pool_ snapshot.py, src/middlewared/middlewared/plugins/zfs snapshot_crud.py snapshot_rollback_impl.py

Address reviews
DeltaFile
+14-39src/middlewared/middlewared/plugins/zfs/snapshot_rollback_impl.py
+0-7src/middlewared/middlewared/plugins/zfs/snapshot_crud.py
+0-2src/middlewared/middlewared/plugins/pool_/snapshot.py
+14-483 files

FreeNAS/freenas e542b87src/middlewared/middlewared/api/v27_0_0 zfs_resource_snapshot.py pool_snapshot.py, src/middlewared/middlewared/plugins/zfs snapshot_crud.py snapshot_rollback_helpers.py

Address reviews
DeltaFile
+39-37src/middlewared/middlewared/plugins/zfs/snapshot_rollback_impl.py
+5-24tests/api2/test_zfs_resource_snapshot_rollback.py
+4-7src/middlewared/middlewared/plugins/zfs/snapshot_rollback_helpers.py
+0-7src/middlewared/middlewared/plugins/zfs/snapshot_crud.py
+1-4src/middlewared/middlewared/api/v27_0_0/zfs_resource_snapshot.py
+1-4src/middlewared/middlewared/api/v27_0_0/pool_snapshot.py
+50-833 files not shown
+54-909 files

FreeNAS/freenas 1f561c9src/middlewared/middlewared/plugins/zfs exceptions.py snapshot_rollback_helpers.py, src/middlewared/middlewared/pytest/unit/plugins/zfs test_snapshot_rollback_helpers.py

Rework snapshot rollback with batched destroys

## Problem
Rolling back past older snapshots destroyed the newer ones one ioctl at a time with no real pre-flight, so a hold or clone discovered midway left some snapshots already gone and, with `recursive_rollback`, a blocked child was only discovered after the parent had already been rolled back - a partially rolled-back tree. Most kernel errors (ESRCH, EBUSY, EDQUOT, ENOSPC) were flattened into `ValidationError(EINVAL)` with a raw strerror, a rollback that had already committed was still reported as a failure when the follow-up zpool-history write failed, and a thick zvol rolled back across a volsize change silently lost its refreservation.

## Solution
- **Enumerate once, up front, for the whole tree.** Newer snapshots are collected for every affected dataset before anything is touched. Without `recursive`, the rollback is refused immediately with every conflicting snapshot named and nothing destroyed; with it, hold/clone blockers are reported before any destroy, and a missing child snapshot fails the whole tree before the parent moves.
- **Batch the destroys.** All newer snapshots go in a single all-or-nothing ioctl per dataset. The kernel checks every snapshot before destroying any, so a blocker - including the long holds from an in-flight send or a `.zfs/snapshot` automount that no pre-flight can see - destroys nothing and is named from the kernel's own error list. A destroy interrupted mid-sync (empty kernel error list) re-enumerates and reports honestly that an unknown number are already gone.
- **Honest error model.** Rollback failures get errno-specific messages; blockers and operational failures surface as `CallError` (EBUSY and friends) while input problems stay `ValidationError`; a committed rollback is never reported as a failure just because the zpool-history write raised afterwards; and any failure partway through a recursive rollback names the datasets that already rolled back, since that cannot be undone.
- **Restore a thick zvol's refreservation** after a rollback that changed the volsize, matching `zfs rollback`. Volumes with a synthetic (larger) refreservation are deliberately left alone, also matching `zfs rollback`.
- **Clones are always unmounted before being destroyed** - `force` now only selects how forcefully - and destroyed via `destroy_resource()`, fixing a path that previously crashed on a method that did not exist.
- **Known limitation: bookmarks are not managed.** A bookmark newer than the target is invisible to the pre-flight and fails the rollback with EEXIST - after the newer snapshots were already destroyed when `recursive` was passed. The error says so and names the manual remedy. TrueNAS itself creates no bookmarks; this only affects externally-created ones.
DeltaFile
+473-106src/middlewared/middlewared/plugins/zfs/snapshot_rollback_impl.py
+448-6tests/api2/test_zfs_resource_snapshot_rollback.py
+146-0src/middlewared/middlewared/pytest/unit/plugins/zfs/test_snapshot_rollback_helpers.py
+138-0src/middlewared/middlewared/plugins/zfs/snapshot_rollback_helpers.py
+119-1src/middlewared/middlewared/plugins/zfs/exceptions.py
+80-0tests/api2/test_pool_snapshot_rollback.py
+1,404-1134 files not shown
+1,493-13410 files

FreeNAS/freenas a6846a1src/middlewared/middlewared/api/v26_0_0 truenas.py, src/middlewared/middlewared/api/v27_0_0 truenas.py

NAS-143057 / 27.0.0-BETA.1 / Redact uploaded license from the audit trail (by sonicaj) (#19606)

This commit fixes an issue where `truenas.license.upload` recorded its
license argument verbatim in the audit trail, because the field was
never declared `Secret[...]`. Uploading needs FULL_ADMIN but audit
records come back with SYSTEM_AUDIT_READ, so a read-only admin could
pull out the blob a full admin installed, and the same record went to
remote syslog and into debug bundles.

Marking the field `Secret[LongNonEmptyString]` means `check_annotations`
stops accepting the old `license_: str` signature, and the
`str(license_)` that went with it turned out to be wrong already: it
stringified the `LongStringWrapper` and wrote `LongStringWrapper(<pem>)`
into the license file. The daemon's PEM scan skips the leading garbage
so nothing ever failed, but the on-disk copy never matched what was
uploaded, which defeats the TNC heartbeat's raw_license comparison and
makes every HA send_license add another wrapper layer. Unwrapping both
boxes writes the PEM back byte for byte.


    [4 lines not shown]
DeltaFile
+33-0tests/api2/test_audit_license.py
+6-2src/middlewared/middlewared/plugins/truenas/license.py
+2-2src/middlewared/middlewared/api/v27_0_0/truenas.py
+2-2src/middlewared/middlewared/api/v26_0_0/truenas.py
+43-64 files