Add Webshare MCP option
## Context
Webshare ships an MCP server configured through the `mcp` block of the webshare-auth config, and there was no way to turn it on from middleware. This brings the MCP settings from master to 27.
## Solution
- **New settings**: `webshare.update` accepts `mcp_enabled`, `mcp_allowed_groups` and `mcp_allow_write`, which are rendered into the `mcp` block. `allowed_hosts` is left unset.
- **MCP groups must be login groups**: webshare only checks login groups at OAuth consent, while token refresh and session spawn check only the MCP groups, so every MCP group must be `truenas_webshare` or an entry of `groups`. Otherwise MCP access could outlive Webshare access. Enabling MCP without a group is rejected, since webshare denies everyone on an empty list.
- **Canonical group names**: MCP groups are resolved through NSS, compared by gid and stored under their canonical name, so a directory service group typed differently from its NSS name still matches its login group entry.
- **Migration**: the new columns are added by a migration that skips itself when they already exist, so the same file can be carried to master alongside its existing revision.
- Validation now collects every error before raising, and the `truenas_webshare` group name lives in a single constant.
[Analysis] Port more cl::opt options to AnalysisOptions (#238015)
Port -enable-tbaa, -enable-scoped-noalias, -disable-last-run-tracking,
-inliner-function-import-stats, -ctx-profile-printer-level,
-enable-detailed-function-properties and
-view-block-freq-propagation-dags.
* The TypeBasedAAResult and ScopedNoAliasAAResult constructors take an
LLVMContext. ScopedNoAliasAAResult::alias(LocA, LocB) is no longer
static.
* Rename -disable-last-run-tracking to -enable-last-run-tracking. The
old spelling remains an alias that accepts no value.
LLM-aided
[VPlan] Avoid exponential recursion in uniformity checks (NFC) (#231607)
Hello, I have attempted to fix #231031.
The root cause lies in isUniformAcrossVFsAndUFs repeatedly traversing
shared operands; each fshl in the issue references the previous value
three times, leading to redundant traversals.
I replaced recursion with a local SmallSetVector worklist to avoid
checking the same value multiple times, while keeping the original
checks in a helper function.
I tested this on Windows x64 using an AMD Ryzen 9 9950X and an LLVM
Release build with assertions enabled. Running opt
-passes=loop-vectorize -disable-output, the median execution time over
three runs dropped from 47.11 seconds to 33.30
milliseconds—approximately 1,415 times faster.
[2 lines not shown]
NAS-144268 / 27.0.0 / Fix KRB5Error mapping of minor codes outside the krb5 error table (by anodos325) (#20123)
KRB5Error took the low byte of any GSSAPI minor code as a KRB5ErrCode.
Codes missing from the enum raised ValueError in the constructor, so the
original error was lost and no `except KRB5Error` handler ran. Minor
codes that are not krb5 codes at all (an errno from the keyring ccache,
a GSSAPI synthetic code) got a wrong name. The enum also lacked
KRB5_CC_NOT_KTYPE and three KRB5_SAM_* codes, so every value from 200 up
was off by one or four.
- Set krb5_code only when the minor code is in the krb5 error table;
otherwise it is None and str() returns the GSSAPI message.
- Regenerate KRB5ErrCode from krb5_err.et (MIT krb5 1.21.3).
- _recover_secrets: a KRB5Error with no krb5_code propagates instead of
faulting as AD_SECRET_INVALID.
- Fix minor codes in two AD tests that did not match their comments.
Original PR: https://github.com/truenas/middleware/pull/20105
Co-authored-by: Andrew Walker <andrew.walker at truenas.com>
[SimplifyCFG] Erase terminator before RAUW when folding empty block (#237414)
BB->replaceAllUsesWith(Succ) calls replaceSuccessorsPhiUsesWith(), which
scans the phis of Succ for entries from BB. When BB is killable, those
entries have already been removed by
redirectValuesFromPredecessorsToPhi(), so the scan finds nothing.
Prerequisite for PR #225647
No functional change; check-llvm and llvm-test-suite output are
unchanged.
Signed-off-by: Max Brandtner <maximilian.immanuel.brandtner at protonmail.com>
Expire directory services cache when an idmap change is saved while disabled
Configuration changes are rejected while directory services are enabled, so
an idmap backend change is normally saved in the call that disables them or
in a later call while they are disabled. The stored configuration then
already matched on re-enable, the only comparison was skipped, and the user
and group cache was never rebuilt. group.query kept returning GIDs from the
old backend, ACLs saved through the UI were bound to IDs that no longer
resolved, and SMB access was denied until directoryservices.cache_refresh
was run by hand.
Compare the stored idmap configuration (including trusted domain settings)
on every update and expire the cache whenever it changes, so that the next
activation rebuilds it.
[bazel] Add a subpackage for libc/src/inttypes (#238078)
Part of https://github.com/llvm/llvm-project/issues/238076. This PR
leaves aliases behind in `libc/BUILD.bazel` just so that any downstream
consumer doesn't need to update in lockstep with this commit. They can
be removed later.
[LSR] Precommit test for LCSSA optimization regression
We end up doing critical edge splitting in this test case which with
LCSSA preservation enabled prevents us from deleting some dead
instructions.
Assisted-By: LLM
Reviewers: nikic, john-brawn-arm, preames
Pull Request: https://github.com/llvm/llvm-project/pull/237531
[mlir][OpenMP] Support different reduction modifiers per variable (#238044)
Previously the OpenMP dialect would use one modifier for the whole
reduction clause. There was no way to express something like
```
!$omp parallel reduction(task, +: x) reduction(default, +: y)
```
Update the clause printing and parsing to render the above example like
```
omp.parallel reduction(task @x_recipe %x_host -> %x_priv,
@y_recipe %y_host -> %y_priv : !x_type, !y_type)
```
Note that the default modifier is omitted.
The dialect does allow missmatched modifiers even when inscan is used.
This is not allowed by the OpenMP standard but it turned out to be
needed if an inscan reduction was combined with the compiler-generated
reductions added for conditional-lastprivate.
[5 lines not shown]
[LSR] Deduplicate Phi Nodes before rewriteLoopExitValues
Otherwise we might end up with duplicate LCSSA phi nodes that cause
rewriteLoopExitValues to bail given the extra uses, which can cause
optimization regressions.
This works towards getting LSR to work with LCSSA IR which is the last
remaining known blocker for enabling the NewPM for CodeGen more broadly.
A set of patches in https://github.com/llvm/llvm-project/pull/235054
shows a mix of improvements/regressions, but an overall improvement.
Reviewers: preames, john-brawn-arm, nikic
Pull Request: https://github.com/llvm/llvm-project/pull/237520
sysutils/ytop: update to 1.1.0
Remove the ncurses dependency in favor of a built-in VT terminal module.
Separate the thread list into a dedicated view with per-thread metrics.
Add a CPU usage grid to the thread view.
PR: 300469
[LSR] Precommit test with duplicate LCSSA Phi Nodes
This test shows an example where we end up with duplicate LCSSA phi
nodes which prevents rewriteLoopExitValues from rewriting an IV use to
an out-of-loop expression.
Assisted-By: LLM
Reviewers: nikic, preames, john-brawn-arm
Pull Request: https://github.com/llvm/llvm-project/pull/237519
ports, jail: Warn instead of erroring on hyphenated PTNAME/JAILNAME
Downgrade the ports-tree hyphen check from a hard err() to a warning,
consistent with the existing SETNAME hyphen warning. Extract the
hyphen check into a shared check_name_hyphen() helper in common.sh and
apply it uniformly at the point each identifier is established:
jail creation, jail rename, and ports tree creation. SETNAME keeps its
existing call in jail_start(), since a set has no separate creation
step -- its first use in a build is effectively its creation.
The warning intentionally doesn't name a specific mechanism (e.g. the
previous "-z" claim for ports tree names): no code path splits a
hyphenated name back into components during normal creation or build
handling. The only place a joined name is ever decomposed is
for_each_build()'s fallback for build logs predating separate
jailname/ptname/setname metadata (2013, a2300607), which no longer
applies to any name established from this point forward. Warning only
at creation time reflects that once a name exists, cautioning about it
again on every later build is not actionable.
[2 lines not shown]
Merge pull request #5719 from daemonhorn/fix/acme-client-false-validation-failed-on-skip
security/acme-client: fix false "validation failed" status on skipped renewal
[NewPM] Make LoopSimplify, RegToMem and StripConvergenceIntrinsics required (#238319)
SPIR-V lowering needs these passes on optnone functions
Their legacy PM versions never skip functions, so mark them required
NAS-144268 / 28.0.0-BETA.1 / Fix KRB5Error mapping of minor codes outside the krb5 error table (#20105)
KRB5Error took the low byte of any GSSAPI minor code as a KRB5ErrCode.
Codes missing from the enum raised ValueError in the constructor, so the
original error was lost and no `except KRB5Error` handler ran. Minor
codes that are not krb5 codes at all (an errno from the keyring ccache,
a GSSAPI synthetic code) got a wrong name. The enum also lacked
KRB5_CC_NOT_KTYPE and three KRB5_SAM_* codes, so every value from 200 up
was off by one or four.
- Set krb5_code only when the minor code is in the krb5 error table;
otherwise it is None and str() returns the GSSAPI message.
- Regenerate KRB5ErrCode from krb5_err.et (MIT krb5 1.21.3).
- _recover_secrets: a KRB5Error with no krb5_code propagates instead of
faulting as AD_SECRET_INVALID.
- Fix minor codes in two AD tests that did not match their comments.
[libc][math] Move CR/RN expf to float_eval_cr_rn namespace (#237614)
Rename `math::float_eval::cr_expf_rn` to `math::float_eval_cr_rn::expf`
and restore namespace-based implementation selection with `using`,
removing the forwarding wrapper.
Also register the missing `check.exp_exceptions` CMake target, which
caused CMake to skip the tests:
```text
Skipping test libc.test.src.math.expf_test as it has missing deps:
libc.src.__support.math.check.exp_exceptions.
```
---------
Signed-off-by: Leandro Augusto Lacerda Campos <leandrolcampos at yahoo.com.br>
NAS-145022 / 28.0.0-BETA.1 / Add memory limit to containers (by Qubad786) (#20119)
## Problem
Containers report 1 PiB of memory and there is no way to cap how much
memory a container can use, because libvirt is always handed a
placeholder 1 PiB value for `<memory>`.
## Solution
Added a `memory` column and API field (MiB, `ge=20`) to containers. The
value is passed to libvirt, which enforces it as a hard cgroup limit and
reports it as the container's MemTotal. When it is unset,
`container.start` uses the host's physical RAM, so containers without a
limit see the real host memory instead of 1 PiB. The Incus import
carries over `limits.memory`, skipping soft-enforced limits and values
that don't parse to at least 20 MiB.
Original PR: https://github.com/truenas/middleware/pull/20116
Co-authored-by: M. Rehan <mrehanlm93 at gmail.com>
