kea: add daemon supervisor support
Kea differs from the other supervised services because keactrl is a short-lived dispatcher which starts several independent daemons in the background. Supervising keactrl itself would only restart the dispatcher, risk duplicate start attempts, and leave daemon(8) unable to distinguish an intentional child stop from a failure.
Extend the shared supervisor helper with reusable profile dispatch. The Kea rc.d wrapper obtains each component command, configuration and enabled state from keactrl.conf, then starts the profile either through daemon(8) or through the native keactrl profile command. Stop checks every supervisor before delegating to the native script, so changing the option cannot leave a supervisor behind; native reload and status continue to use the Kea PID files.
Expose Restart on failure independently for DHCPv4, DHCPv6, DHCP DDNS and the Control Agent. Unchecked profiles retain their existing lifecycle, supervised and native profiles can be mixed, and the default configuration remains unchanged.
[mlir][NFC] Fix some different sign comparison warnings (#234999)
I saw these doing a build on Arm 32-bit, but I don't think they're
specific to it.
* OperationSupport.h: std::distance returns a signed type but
kSmallAttributeList is unsigned. I assume first is always before last,
so it's safe to cast std::distance to size_t.
* In MemRefOps.cpp: srcStaticCount is created using llvm::count_if, but
the type is changed. Then later compared to another llvm::count_if.
Fixed that by using auto to keep the same type.
* ModuleTranslation.cpp: numArguments is unsigned, and by using
llvm::range_size we get a size_t we can compare to.
[AMDGPU] Update check lines with extra text at the start or end. NFC. (#236029)
This comes from re-autogenerating the checks, but only committing a
specific kind of change where the check line gets extra text at the
start or end. These are cases where the existing check line only worked
because it did not have {{^}} or {{$}} anchors.
ocs_fc: Fix config space bounds, double PRLI response and a stack overflow
Fix three unrelated problems found by security review of the driver.
ECD helper ioctl:
- OCS_ECD_HELPER_CFG_READ* and OCS_ECD_HELPER_CFG_WRITE* passed a user
supplied offset straight to pci_read_config() and pci_write_config().
Reject accesses that extend past PCIE_REGMAX, so that a wide access
starting in range cannot run past the end of config space.
- Use the real access width (1, 2 or 4 bytes) of the command for both
the BAR and the config space checks, rather than assuming 4 bytes, so
that narrow accesses at the very end of the BAR or config space are
not rejected while wider ones remain bounded.
PRLI:
- When a PRLI carries an FC-4 type other than the one the driver
supports, ocs_d_send_prli_rsp() sent an LS_RJT and started node
shutdown, but then fell through and sent a second response on the same
IO (another LS_RJT, or a PRLI LS_ACC when the initiator is accepted),
[19 lines not shown]
ocs_fc: Harden ioctl, XRI lookup and FCP command validation
Fix several issues found by security review of the driver.
ioctl:
- Require PRIV_DRIVER for all ocs ioctls and create the device node
with mode 0600, group wheel.
- Return the error from ocs_process_sli_config() to the caller.
Previously only ENXIO was propagated, so a failed validation or a
failed copyin() still issued the mailbox command, in the latter case
with a descriptor pointing at freed memory.
- Reject COMMON_WRITE_OBJECT when in_bytes exceeds
desired_write_length, and cap WRITE_OBJECT, READ_OBJECT,
READ_OBJECT_LIST and non-embedded mailbox buffers at
OCS_MAX_DMA_ALLOC, returning EINVAL.
- Use a 64-bit size for the non-embedded mailbox buffer to avoid
truncation of a user supplied length.
- Refuse to copy out more than the size of the DMA buffer allocated
for the command.
[19 lines not shown]
[mlir][tosa] Move ResizeOp shape checks from verifier to tosa-validate (#234101)
Part of #233457.
`ResizeOp::verify()` reads `scale`/`offset`/`border` from their
`tosa.const_shape` producers and checks their values. That is not local
to the
operation, so these `ERROR_IF` conditions move to `tosa-validate`.
Changes:
- `ResizeOp::verify()`: drop the constant-value checks (non-positive
scale,
output size divisibility / calculated size); keep only the local check
that
block-scaled input requires `NEAREST_NEIGHBOR` mode.
- `checkErrorIfResize()`: add the missing `scale > 0` check.
- `levelCheckResize()` and `ResizeOp::inferReturnTypeComponents()`: bail
out on
[2 lines not shown]
[ARM] Don't map ISD::STRICT_FRINT to vector VRINTX (#234644)
The VRINTX instruction on a scalar float respects the rounding mode in
FPSCR, but on a vector of floats, it rounds to nearest always. That
makes it the wrong choice for ISD::STRICT_FRINT, which must use the
dynamic rounding mode. It's only acceptable for ISD::FRINT.
This applies to both MVE and NEON. (The latter only for Armv8 and above:
Armv7 NEON doesn't have that instruction in the first place).
[OpenMP][offload] Trade threads for blocks in Generic-SPMD kernels (#234191)
For Generic-SPMD mode, the trip count refers to the outer distribute
loop, the per-iteration cost is unknown. So, prefer more blocks and less
threads for this exec mode. This prevents large blocks with only few
active threads.
This is an upstream port of the corresponding downstream.
Claude assisted with this patch.
[CODEOWNERS] Drop all notifications (#236030)
The author would like to drop all CODEOWNERS notifications added in
c4e40dc23 ([CODEOWNERS] Request notifications, #227742) as they have
realized a sharp downside: it is impossible to distinguish cases where
their review was explicitly requested.
See also: #228086.
py-pyrate-limiter: updated to 4.5.1
4.5.1
Bug fixes only. One behaviour change to note: a decorated call that the limiter
can never admit now raises instead of running (see the first entry).
Fixed
- **`as_decorator` ran the wrapped function even when denied.** Both the sync
and async wrappers discarded the result of `try_acquire()` and called the
function unconditionally. With the default `blocking=True, timeout=-1` that
result is only `False` when the weight can never be admitted under the
configured rates (e.g. `weight=5` on `Rate(2, Duration.SECOND)`), so the
limiter's verdict was silently bypassed. Such calls now raise `RuntimeError`.
- **`Limiter.close()` never closed its buckets.** `BucketFactory.close()` read
the bucket list off the leaker after tearing the leaker down, so it always
iterated an empty list: SQLite connections and Postgres connection pools
stayed open. It now snapshots the buckets first. `SingleBucketFactory` also
closes its bucket when no leak was ever scheduled; factories that hold buckets
[21 lines not shown]
service: add reusable daemon(8) supervisor
Critical services can occasionally disappear after an OOM kill, crash or unexpected signal. This is especially disruptive when Suricata runs in divert-to mode: if it no longer consumes and reinjects packets, most traffic can stop until the service is restarted manually. Other vital system services have similar, albeit rare, failure modes.
Use daemon(8) as a small, reusable safety harness for supported services. A shared rc.subr helper starts a foreground service below daemon(8), tracks the supervisor and child independently, forwards stop and reload operations, and removes stale service PID files before restart attempts. Bounded retries with a delay prevent a permanently failing service from looping without limit.
This is intentionally a narrow initial implementation. Its boundary is a single service process that can run in the foreground and be dispatched by daemon(8). Services with their own process dispatcher, multiple independent children, or a custom lifecycle need additional integration before they can use it safely.
