[MC][X86] Reintroduce aligned instruction bundling (#175830)
Aligned bundling partitions instructions into fixed-size, naturally
aligned groups called bundles and guarantees that no instruction
crosses a bundle boundary, giving the instruction stream a single
canonical decoding. It is a building block for software-based fault
isolation: control flow cannot jump into the middle of an instruction
to manufacture a different, unchecked sequence, and when combined with
masking of indirect branch targets it constrains control flow to a
statically verifiable set of locations.
The previous target-independent implementation was removed in #148781,
which simplified MC by eliminating per-fragment BundlePadding, the
virtual emitInstToData, and BundleGroupBeforeFirstInst. This change
reimplements the feature in the X86 backend on top of the existing
MCBoundaryAlignFragment infrastructure added for branch alignment,
keeping the generic MC surface smaller:
* AsmParser parses .bundle_align_mode, .bundle_lock and .bundle_unlock
[36 lines not shown]
[Flang][OpenMP][OpenMPIRBuilder] Implement module scope declare target use rewrite mechanism (#212920)
During lowering of declare target'd variables we generate new global
variables for device that replace the use of the pre-existing global
variable. In Flang we currently rewrite this for each target region, but
that's not enough to cover indirect use cases inside of declare target
functions which can be imported into the module and utilised inside of a
target region. This PR tries to extend the scope of the rewriting to the
module than a per target region rewrite.
It does so by creating a mechanism where we can register globals for
replacement which will trigger on finalization of the OMPIRBuilder. This
is required as due to the ordering of lowering for MLIR, where we
generate the replacement global at the beginning of the module before
any uses have been generated, effectively meaning we cannot replace the
uses at that point. So, we defer the replacement to the OMPIRBuilder as
there is no deferral mechanism directly in the OpenMP MLIR lowering.
The alternative might be to rebind the global maps in ModuleTranslation
[7 lines not shown]
[CIR] Fix record layout for a union with no storage type (#213591)
A union whose CIR type ends up with no members keeps its whole size in
its
padding field, and `UnionType::getTypeSizeInBits` returned early in
exactly that
case, before reaching the padding. A union need not look empty in the
source to
land there: a lone zero-length bitfield is dropped during lowering,
leaving the
same no-storage state.
A record embedding such a union was then laid out wrong. In an unpacked
record
`insertPadding` pads whenever the end of the members placed so far,
rounded up
to the next member's alignment, falls short of that member's offset, so
a union
measuring zero earns a pad the AST layout does not have. In C++,
[22 lines not shown]
Keep container records unless their pool was really destroyed
## Problem
The container FS attachment delegate was the only stateful-workload delegate whose `delete()` destroyed configuration: it undefined the libvirt domain and removed the `container_container` and `container_device` rows, while deliberately leaving the rootfs dataset alone. VMs and apps only stop. That made `pool.export(cascade=True, destroy=False)` — the flow that exists precisely because the pool is moving elsewhere intact — permanently orphan live storage. A container's definition, devices and idmap slice live only in SQLite, nothing on disk can rebuild them (unlike the migrated incus containers, we write no manifest), and a freed idmap slice can be reissued to another container while the surviving rootfs still carries its UID range.
`pool.dataset.delete` reached the same code with no cascade flag at all, so deleting a dataset that a container merely bind-mounted as a FILESYSTEM device destroyed the whole container. And since `query()` only reports containers in ACTIVE_STATES, the cleanup was not even coherent — it dropped the records of running containers and kept those of stopped ones.
## Solution
- **`delete()` is now stop-only**, matching the VM and apps delegates. Records are never removed from the delegate.
- **Record removal moved to a new `destroy()` step on the attachment delegate**, which `pool.export` calls once the zpool destroy has returned — the only point that can see whether the data actually went away. `delete()` still has to run first so the datasets are released, whereas discarding configuration is safe only once the data it describes is confirmed gone, and everything in between (the `pool.pre_export` hook, `kill_processes`, the destroy itself) can abort the job with the pool still fully intact. It is gated on `cascade` together with a `destroyed` flag reflecting what the export really did rather than `options['destroy']`: asking to destroy an OFFLINE pool leaves it untouched on its disks, so the requested option on its own would still have discarded records whose storage was intact. The base implementation is a no-op, since the share/task delegates already disposed of their attachments in `delete()` while the pool was still there; the container one matches on the pool its root dataset lives on and ignores runtime state, so stopped containers are cleaned up too, and a container merely bind-mounting the destroyed pool keeps its definition.
- **Containers are re-pointed at their storage when a pool is imported under a new name.** The dataset is always `<pool>/.truenas_containers/containers/<name>`, so the new location is derived rather than guessed. The remap is committed only when the old pool is genuinely gone, the derived dataset exists, and no other container claims it; each container is applied behind its own boundary so one failure cannot abort the import or block the rest.
- **`pool.reimport` no longer starts everything on the pool.** It walks the delegates in start-priority order (it was using registration order, quietly defeating the docker/apps ordering) and calls a new `start_on_import`, which containers and VMs override to honour `autostart`. Previously every stopped container and VM on the pool came up regardless.
Also documents why `storage_paths()` derives the container root from the dataset name rather than its real mountpoint — both consumers need the name-derived form, and switching to the mountpoint would silently stop matching containers on pool export and lock.
[DAGCombine] Fold (select_cc (select cond, x, y), x, a, b, eq) to (select cond, a, b) (#199688)
(select_cc (select cond, x, y), x, a, b, eq) which could be simplified
to (select cond, a, b)
Consolidate the managed-dataset registries and guard every mutator
## Problem
"Is this a dataset middleware manages?" was answered by five separate registries with four membership sets and three matching algorithms: `INTERNAL_PATHS` in `plugins/zfs/utils.py`, `INTERNAL_DATASETS` in `plugins/pool_/dataset_query_utils.py`, `internal_datasets_filters` in `plugins/pool_/dataset.py`, inline literals in `alert/source/datasets.py`, and `INVALID_DATASETS` in `plugins/zettarepl.py`. None had unit coverage, and they had drifted: `<pool>/ix-applications` was creatable and then permanently invisible because one carried a trailing slash the others lacked, `<pool>/ix-apps-data` was hidden forever on a substring match, and the replication registry did not know about the apps datasets at all. A sixth spelling in `docker/fs_manage.py` tested `startswith("boot-pool/")`, so it missed `freenas-boot` entirely and reported the boot pool's own root dataset as the mounted apps dataset on any system upgraded from a FreeNAS-era install.
"May this caller change it?" was answered by a `bypass` field on seven public snapshot request models. It was declared `SkipJsonSchema`, which hides a field from the generated docs and JSON schema but does not block it at validation, so any caller holding `SNAPSHOT_WRITE` could send `bypass: true` and defeat every guard. The read side had the same defect twice: `exclude_internal_paths` on `ZFSResourceQuery`, and `exclude_internal_datasets` read out of `pool.dataset.query`'s free-form `extra` dict, where the model's `extra="forbid"` never reaches because it governs unknown model fields rather than keys inside a dict value. Either one let a caller holding nothing but read access enumerate every managed dataset, boot pool included. The root cause is the same in all three: an authorization decision encoded as request data -- a property of the caller modelled as a field of the request.
Separately, ten public mutators had no protection at all and none of them funnelled through a guarded implementation: `pool.dataset.promote`, `rename`, `set_quota`, `get_quota`, `lock`, `change_key` and `inherit_parent_encryption_properties`, both `zfs.tier` mutators, and `pool.snapshot.rename`. `promote` was the worst of them, since managed children are frequently clones and promoting one reparents its origin snapshot. `pool.snapshot.rename` turned out to be unreachable in any case: it passed a snapshot id to `zfs.resource.rename`, which rejects any name containing `@`, so the endpoint could not succeed for any valid input and had no test coverage.
## Solution
- **One module, one predicate per question.** `utils/zfs/managed_datasets.py` replaces all five registries, with one function per caller decision -- `hidden_from_zfs_listing`, `hidden_from_dataset_listing`, `blocked_from_mutation`, `reserved_from_user_creation`, `excluded_from_zfs_events`, `excluded_from_replication` -- each spelling out its own membership and its own matching rule where you can read both at once. Two rules cover everything: compare a whole path component, or look for `/<name>` anywhere. The refusal helpers `deny_protected_path` and `deny_protected_snapshot` sit in the same file directly beneath the predicate they gate, so answering "is this ours?" and "may this caller change it?" is one place to look rather than two files to choose between. Callers that must accumulate into `ValidationErrors` mid-pass, or that want to name the containing dataset rather than the path they were handed, ask the predicate directly; the helpers are a convenience for the one common message shape, not a boundary.
- **Two matching rules converged; everything else preserved.** `hidden_from_dataset_listing` now compares a whole path component like the ZFS listing does, rather than searching for a substring. `<pool>/ix-apps-data`, `<pool>/.systembackup` and `<pool>/foo/.system` are no longer hidden from `pool.dataset.query`, which had left them unmanageable -- the lookups behind `get_instance`, `update` and `delete` all run through that listing, so those datasets answered ENOENT forever. Separately, the creation and event views lose the trailing slash on their `ix-applications` needle, so `<pool>/ix-applications` is now refused at creation instead of being created and then vanishing from every listing. Both changes only ever expose or refuse; nothing is newly hidden, and no owner subsystem loses access. Every other predicate keeps the matching algorithm its callers used before, so the predicates still disagree with one another in places -- those disagreements are what the five registries were quietly doing in five spots, and they are now visible in one source file instead. `.truenas_containers` takes part in the product listing only, reproducing today's behaviour while containers are addressed separately; that leaves it destroyable through `zfs.resource.destroy` while `pool.dataset.delete` answers ENOENT, which is written down rather than quietly fixed.
- **The overrides are off the wire.** `bypass`, `exclude_internal_paths` and `exclude_internal_datasets` are gone from the public surface, replaced by parameters on `@private` implementations, which JSON-RPC cannot populate because it dispatches through the request model. `pool.dataset.query` had no private chokepoint to move its flag onto, so `query_impl` is added and the shared body factored out behind it; a key a caller leaves in `extra` is popped and discarded rather than rejected, since it was never on a model and ignoring it fails in the safe direction. The mutation privilege is now a typed `InternalAccess` enum rather than a bool, so a stray value fails closed instead of silently permitting, and `InternalAccess.ALLOW` is a unique token that greps out the complete list of privileged callers. It is str-valued and coerced rather than identity-compared so it survives the JSON hop in `failover.call_remote`, which the audit dataset relies on -- and because the value genuinely arrives as a plain string on the peer node, the receiving implementations type the parameter `InternalAccessArg`, so nobody is invited to write an identity test that would read as DENY on one node of an HA pair. `v26_0_0` is left alone: the version adapter already drops fields absent from the newer model, and editing a frozen version would turn a silent drop into a hard failure for old clients.
- **This adds owner opt-ins, it does not merely rename them.** Sixteen call sites already passed `bypass=True`, but there are forty `InternalAccess.ALLOW` sites now, because guarding `pool.dataset.update_impl` and `zfs.resource.unload_key` pulled in owners that previously needed no opt-in at all. The new ones sit on pool import, the system dataset, audit (including the HA `call_remote` hop), docker's mount management and the container migration -- boot and failover paths, which is the argument for the guards living where they do: a missing opt-in fails loudly inside that owner's own workflow rather than silently widening access.
[6 lines not shown]
[CodeGen] Fix -fsanitize=array-bounds for __sized_by / _or_null pointers
`EmitCountedByBoundsChecking()` assumed a CountAttributedType is always
a __counted_by pointer. That isn't true, there are four versions of the
attribute:
* `__counted_by`: Already handled correctly.
* `__counted_by_or_null`: Incorectly handled.
* `__sized_by`: Incorreclty handled.
* `__sized_by_or_null`: Incorreclty handled.
In particular:
* __sized_by / __sized_by_or_null: the loaded bound is a byte count, but the
element index was compared against it directly, so an access was only
flagged once the index exceeded the byte count -- missing out-of-bounds
accesses for a pointee larger than one byte. Scale the index to bytes
('index * sizeof(element)') before comparing. counted_by counts elements
and is unchanged; a void (or otherwise zero-sized) pointee uses the GNU
[13 lines not shown]
gettytab(5): man page fixes
- add missing "ab" capability
- "ps" is for a Develcon port selector, not MICOM port selector
- the "uc" capability is still supported (kind of)
- document the historical "td" capability
- document the historical "he" capability
- split the unsupported section into delay capabilities and others
- since all the historical delay capabilities are unsupported we can
delete the paragraph in BUGS that references them
- for the same reason, the paragraph talking about delays being in
milliseconds can also be deleted
tweaks and ok jsg@
[CodeGen] Fix __builtin_dynamic_object_size for __sized_by / _or_null pointers
`emitCountedByPointerSize()` assumed a CountAttributedType is always
a __counted_by pointer. That isn't true, there are four versions of the
attribute:
* `__counted_by`: Already handled correctly.
* `__counted_by_or_null`: Incorectly handled.
* `__sized_by`: Incorreclty handled.
* `__sized_by_or_null`: Incorreclty handled.
In particular:
* __sized_by / __sized_by_or_null: the attribute argument is a byte count,
but the object size was computed as count * sizeof(*ptr), over-reporting by
the element size for any pointee larger than one byte. Use the count
directly for the byte-counting variants.
* __counted_by_or_null / __sized_by_or_null: a null pointer describes no
[20 lines not shown]
clang: Use TargetID parsing from AMDGPUTargetParser (#209845)
We had grown 2 parallel parsing implementations for
triple+gpu name+feature flag target ID strings. Mostly
eliminate the redundant clang version.
Co-authored-by: Claude (Opus 4.8)
[CodeGen][NFC] Split __sized_by tests into their own file and rename test cases
In future patches the coverage of the __counted_by family attributes is
going to be increased. To help with this patch refactors the existing
test file.
1. Split `__sized_by` tests into their own file. In later commits files
will be added for each attribute so it makes sense for each attribute
to have its own file.
2. Replace `testN` test case names with human readable descriptions. Not
all test cases that will be added in the future will apply to all
attributes. If we kept on using the `testN` naming convention it
would leave odd gaps in the test numbering because we try to keep
what a test case tests consistent between files (i.e. `testN` would
roughly test the same thing but with a different attribute). Using
named test cases completely avoids this.
[clang][darwin] armv6m Firmware crashes spilling the TLS wrapper (#213595)
Thread local storage isn't universally supported on all architectures.
Only enable it for the ones that are known to support it.
rdar://183822457
math.h: replace a standards placeholder with an official version
guenther@ also points out these are XSI extensions and so we should
adjust from __POSIX_VISIBLE to __XPG_VISIBLE.
ok guenther@ (some time ago), ok sthen@
[LoopUnroll] Fix freq accuracy calculations (#213762)
This problem was reported at
<https://github.com/llvm/llvm-project/pull/182405#issuecomment-5165268733>
for the case of very large loop probabilities.
The biggest issue is that, when using linear and quadratic equations to
determine loop latch probabilities, asserts introduced by PR #182405 to
verify the accuracy of the resulting loop body frequency can fail.
Another issue is that iterations introduced by PR #182404 and PR #182405
terminate upon achieving a desired accuracy, but they can iterate longer
than necessary, wasting time achieving higher accuracy than desired.
This patch fixes the accuracy calculations to use relative differences
instead of absolute differences. It updates existing tests that reveal
the impact on the N>2 uniform case. Its adds new tests to cover the N=1,
N=2, and N>2 fast cases.
Consolidate metadirective lowering TODO tests
Group related block, loop data-environment, iteration-variable, and unsupported-replacement cases into split-file tests. This keeps each diagnostic isolated while reducing the number of TODO test files.
[SPIR-V] Legalize wide-vector atan2 by splitting first (#213341)
fixes #213340
This was simple fix we just had to change the order in which we were
doing the splitting and widdening.
This change prioritize splitting G_FATAN2 vectors wider than four
elements before attempting power-of-two widening, which G_FATAN2 does
not support.
Add float and half coverage for vector widths 6, 8, 9, 12, and 16.
AMDGPU: Validate generic processor features in TargetParser emitter
Perform some initial validation that the feature set of generic
targets is consistent with the set of covered targets. For now, this
only validates the frontend exported list so it should be good for
catching missed builtins that ought to be accepted on the generic.
In the future arbitrary features should be validated, but this is
complicated by workaround features and size features which need to
clamp to the common monimum.
Co-authored-by: Claude (Claude-Opus-4.8)
