[mlir] Fix linking `MLIRTestAliasAnalysis` to libMLIR (#223711)
Fixes regression introduced in 36fe08a5f92230655dd9662f121c092ced307ddd.
Signed-off-by: Michał Górny <mgorny at gentoo.org>
[libc++] Don't assume a valid range in find_if for empty inputs (#213752)
Iterators for empty ranges are sometimes implemented using a
non-aligned sentinel value. Requiring proper alignment in that
case (which is part of the valid range assumption) causes a
hardening failure. Instead, don't make the assumption of a
valid range when the input range is empty in find_if.
[flang][acc] Ensure private recipe optional yields expected type (#223542)
Updates private recipe lowering so that locally allocated variables are
converted to the recipe result type.
NAS-143766 / 27.0.0-BETA.1 / improve truenas_s3 validation (#19713)
Mirror the daemon's refusals in the API and the render: region grammar,
dotted-quad bucket names with leading zeros, duplicate audit actions,
colliding grant-heading labels. Enforce the one-way fields (object lock,
versioning) plus explicit object_ownership when leaving MULTIPROTOCOL,
unwind failed bucket creates fully, take naive access key expiries as
UTC, and keep each port's TLS posture across a listener reset.
Derive base_hosts and truenas_version at render time, re-rendering on
network changes, for virtual-hosted addressing and the SOSAPI ModelName.
Extend the audit mask vocabulary to the daemon's 21 actions and the
audit event schema to every operation it emits.
---------
Co-authored-by: Caleb St. John <30729806+yocalebo at users.noreply.github.com>
(cherry picked from commit 0baf5003b5548debe565c3e14185de009d9bc485)
NAS-143402 / 26.0.0 / Stricter user SSH public key validation to match OpenSSH behavior (#19652)
sshd opens the `authorized_keys` file as the user itself, so every
directory leading to the home directory has to
be traversable by the account.
On top of that `StrictModes` makes sshd refuse to use the file when the
home directory is world-writable or is
owned neither by the user nor by root.
A public key that is stored under any of those conditions silently never
authenticates anyone, so it should be rejected up front.
[libc][bazel] Adds missing targets for bf16 smoke tests (#223343)
This pr addresses #221026 and adds the missing bazel targets for the
bf16 smoke tests.
NAS-142893 / 26.0.0 / Make `filesystem.file_tail_follow` tail the file on repeated connect (by themylogin) (#19688)
Previously, if one browser tab is already connected to this event source
and a second tab is opened, the second tab does not receive anything
from `filesystem.file_tail_follow` source (it is re-used).
Now, the last N read lines are buffered in RAM, so newly connected tab
will also receive last N files.
The buffer is capped: it is not possible to request more than 1000 lines
(currently, UI requests 500), and each line is no longer than 1024
characters (otherwise, it is counted as `len(line) // 1024` lines).
Original PR: https://github.com/truenas/middleware/pull/19595
---------
Co-authored-by: themylogin <themylogin at gmail.com>
Co-authored-by: Caleb St. John <30729806+yocalebo at users.noreply.github.com>
riscv: Preserve savectx return address with vector support
Calling vector_state_store_savectx() overwrites ra with the address of
the following ret instruction. The ret consequently branches to itself
and prevents kernel dumps from progressing past dump_savectx().
Tail-call vector_state_store_savectx() so that it returns directly to
the original savectx() caller.
Reviewed by: br, jrtc27
Approved by: jrtc27
Fixes: d7a393095cfd ("riscv: Vector Extension (RVV) support.")
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59689
Add the S3_AUDIT and S3_VERSIONING license features
S3 auditing and bucket versioning are now decided by the license rather
than by the hardware. Both features use a key only rule in the product
matrix, so a system is entitled when its license carries the key, on
appliance and community hardware alike. Legacy licenses do not receive
either key because the S3 service is new and nothing in the field has it.
The S3 config service asks the entitlement engine in one place instead
of reading the chassis, and bucket validation refuses turning versioning
on without the key. A bucket that already has versioning keeps it, since
versioning cannot return to OFF. The integration tests toggle the
entitlement mock rather than skipping off appliance hardware.
Audit records still only reach the audit database on appliance hardware
until the audit handler daemon learns to forward S3 records on community
systems. That change lives in the audit_rules repo.
bhyve: tpm: allow the last dword of the CRB command buffer
The bounds check rejected any access ending exactly at the end of the
register block, so a four byte write at offset 0xffc was refused,
returning EINVAL and killing the VM.
MFC after: 1 week
PR: 291063
Fixes: 75909086a45d ("bhyve: allow read/write to full CRB buffer")
Sponsored by: Defenso
Signed-off-by: Quentin Thébault <quentin.thebault at defenso.fr>
Reviewed-by: aokblast, kevans, markj
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2362
NAS-143611 / 27.0.0-BETA.1 / Reject recursive permissions changes on S3 bucket mountpoints (#19693)
filesystem.chown, filesystem.setperm and filesystem.setacl now refuse a
recursive change whose path is the mountpoint of a dataset consumed by
an S3 bucket, or that would traverse into one from above. The error
points the caller at the bucket's s3data directory instead, since a
recursive change over the whole bucket may have undefined behavior and
expose security risks.
[libc++] Implement `<bit>` parts of P3793R2 Better shifting (#219389)
Partially implements #204401
That is, the scalar `<bit>` parts are implemented, but the `<simd>`
overloads are missing. Notice that only `__cpp_lib_bitops` is set to
`202606L`. `__cpp_lib_simd_bitops` is missing.
The implementations of `shl` and `shr` are based on the reference
implementation in the paper. The test code is partially AI-generated and
inspired by the test code for `rotl` or `rotr`, but comes with
significant modernizations.
[clang][CIR] Add code-gen for DUP intrinsics for bool types (#223459)
As per SVE ABI, the storage type for svbool_t is `vector<vscale x 16 x i1>` (i.e. full predicate register) and that's what the change in `emitToMemory` reflects (see LowerToLLVM.cpp).
AMDGPU: Use LiveIntervals in SIOptimizeVGPRLiveRange when available
LiveVariables has been long deprecated. Use LiveIntervals if available.
With the current pass structure, this will use LiveVariables.
Co-authored-by: Claude (Claude-Opus-4.8)
Reject recursive permissions changes on S3 bucket mountpoints
filesystem.chown, filesystem.setperm and filesystem.setacl now refuse
a recursive change whose path is the mountpoint of a dataset consumed
by an S3 bucket, or that would traverse into one from above. The error
points the caller at the bucket's s3data directory instead, since a
recursive change over the whole bucket may have undefined behavior and
expose security risks.
RegisterPressure: Remove dead defs correctly (#222627)
When an instruction has overlapping register defs where only some carry
the dead flag (for example a dead super-register def alongside a live
sub-register def), the collector left the shared register units in both the live and
dead def sets. That produced a PressureDiff decrement with no matching increment
and tripped the "PSet overflow/underflow" assertion in getUpwardPressureDelta.
A register unit is dead if any def covering it is dead, regardless of
operand order. Reconcile by subtracting the dead defs from the live defs instead
of the reverse: removeRegLanes only clears the overlapping units, so a def
keeps any units a dead def does not cover.
Fixes #155807.
Fixes #149144.
Fixes #76416.
Fixes #205272.
Co-authored-by: XChy <xxs_chy at outlook.com>
Co-authored-by: Claude claude-opus-4.8 <noreply at anthropic.com>
[X86] LowerFP_TO_INT_SAT - use MVT src/dst types directly. NFC. (#223689)
Only the saturation type needs to be EVT during lowering
Cleanup to reduce diff in #199416
