Cherry-picks for 10.2.1 (2026-09-22)

cmake/Check128BitCas.cmake

@@ -21,6 +21,16 @@
 #
 #     TS_HAS_128BIT_CAS
 #     TS_NEEDS_MCX16_FOR_CAS
+#     TS_HAS_128BIT_CAS_LIBATOMIC
+#     TS_NEEDS_LIBATOMIC_FOR_CAS
+#
+# TS_HAS_128BIT_CAS means the 16-byte __sync builtins compile and link, which the
+# compiler only allows when it can emit an inline lock-free sequence.
+#
+# TS_HAS_128BIT_CAS_LIBATOMIC is the fallback for targets with no inline 128-bit
+# CAS (e.g. riscv64): the __atomic builtins lower to libatomic calls, which may
+# be lock-based there.  The __sync builtins never lower to libatomic calls, so
+# the fallback has to use __atomic.  The two are mutually exclusive.
 #
 
 set(CHECK_PROGRAM
@@ -33,6 +43,22 @@ set(CHECK_PROGRAM
     "
 )
 
+set(CHECK_PROGRAM_ATOMIC
+    "
+    int main(void)
+    {
+        __int128_t x = 0;
+        __int128_t y = 0;
+        __atomic_load(&x, &y, __ATOMIC_SEQ_CST);
+        return !__atomic_compare_exchange_n(&x, &y, 10, 0, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST);
+    }
+    "
+)
+
+set(NEED_MCX16 FALSE)
+set(USE_LIBATOMIC_CAS FALSE)
+set(NEED_LIBATOMIC FALSE)
+
 include(CheckCSourceCompiles)
 check_c_source_compiles("${CHECK_PROGRAM}" TS_HAS_128BIT_CAS)
 
@@ -44,12 +70,41 @@ if(NOT TS_HAS_128BIT_CAS)
   unset(CMAKE_REQUIRED_FLAGS)
 endif()
 
+if(NOT TS_HAS_128BIT_CAS)
+  check_c_source_compiles("${CHECK_PROGRAM_ATOMIC}" TS_HAS_128BIT_CAS_BUILTIN_ATOMIC)
+  if(TS_HAS_128BIT_CAS_BUILTIN_ATOMIC)
+    set(USE_LIBATOMIC_CAS TRUE)
+  else()
+    unset(TS_HAS_128BIT_CAS_BUILTIN_ATOMIC CACHE)
+    set(CMAKE_REQUIRED_LIBRARIES atomic)
+    check_c_source_compiles("${CHECK_PROGRAM_ATOMIC}" TS_HAS_128BIT_CAS_BUILTIN_ATOMIC)
+    unset(CMAKE_REQUIRED_LIBRARIES)
+    if(TS_HAS_128BIT_CAS_BUILTIN_ATOMIC)
+      set(USE_LIBATOMIC_CAS TRUE)
+      set(NEED_LIBATOMIC TRUE)
+    endif()
+  endif()
+endif()
+
 set(TS_NEEDS_MCX16_FOR_CAS
     ${NEED_MCX16}
     CACHE BOOL "Whether -mcx16 is needed to compile CAS"
 )
 
+set(TS_HAS_128BIT_CAS_LIBATOMIC
+    ${USE_LIBATOMIC_CAS}
+    CACHE BOOL "Whether 128-bit CAS uses the __atomic builtins as a fallback"
+)
+
+set(TS_NEEDS_LIBATOMIC_FOR_CAS
+    ${NEED_LIBATOMIC}
+    CACHE BOOL "Whether libatomic is needed to link CAS"
+)
+
 unset(CHECK_PROGRAM)
-unset(NEEDS_MCX16)
+unset(CHECK_PROGRAM_ATOMIC)
+unset(NEED_MCX16)
+unset(USE_LIBATOMIC_CAS)
+unset(NEED_LIBATOMIC)
 
-mark_as_advanced(TS_HAS_128BIT_CAS TS_NEEDS_MCX16_FOR_CAS)
+mark_as_advanced(TS_HAS_128BIT_CAS TS_NEEDS_MCX16_FOR_CAS TS_HAS_128BIT_CAS_LIBATOMIC TS_NEEDS_LIBATOMIC_FOR_CAS)

doc/admin-guide/configuration/hrw4u.en.rst

@@ -115,6 +115,27 @@ This is particularly useful for build systems or when processing many configurat
 files at once. All files are processed in a single invocation, improving performance
 for large batches of files.
 
+Exit Status
+^^^^^^^^^^^
+
+====== ==========================================================================
+Status Meaning
+====== ==========================================================================
+0      Every input compiled. Warnings may still have been reported.
+1      At least one input had an error, or the run aborted on a fatal problem:
+       a missing or unreadable input, an unwritable output, or ``input:output``
+       pairs mixed with plain file arguments.
+2      The command line was rejected before any input was read: an unknown
+       option, an invalid option value, or conflicting output modes. This comes
+       from ``argparse`` and follows Python's usage-error convention.
+====== ==========================================================================
+
+A compile error does not stop the run: every input is still processed before
+the status is decided, so one bad file in a multi-file or bulk run does not
+skip the files after it. The fatal problems above still abort immediately. A
+failing compile writes its partial output; the exit status is what marks that
+output untrustworthy.
+
 Reverse Tool (u4wrh)
 ^^^^^^^^^^^^^^^^^^^^
 
@@ -697,6 +718,7 @@ Schema for editor validation and autocomplete is provided at
        conditions:  [ ... ]   # condition keys, e.g. geo.
        operators:   [ ... ]   # operator keys, e.g. inbound.conn.dscp
        language:    [ ... ]   # break, variables, in, else, elif
+       modifiers:   [ ... ]   # condition modifiers, e.g. NOT, NOCASE
      warn:
        functions:   [ ... ]   # same categories as deny
        conditions:  [ ... ]
@@ -778,9 +800,24 @@ Construct        What it controls
 ``variables``    The entire ``VARS`` and ``SESSION_VARS`` section and all variable usage
 ``else``         The ``else { ... }`` branch of conditionals
 ``elif``         The ``elif ... { ... }`` branch of conditionals
-``in``           The ``in [...]`` and ``!in [...]`` set membership operators
+``in``           Set membership: the ``[...]`` value form and
+                 the ``{...}`` IP range form, negated or not
 ================ ===================================================
 
+Condition Modifiers
+-------------------
+
+The ``modifiers`` list accepts ``AND``, ``OR``, ``NOT``, ``NOCASE``, ``PRE``,
+``SUF``, ``EXT``, ``MID``, ``I``, ``L`` and ``QSA``. Entries match the modifier
+however it is written, not only the explicit ``with`` form: ``AND`` also covers
+``&&``, ``OR`` also covers ``||``, and ``NOT`` also covers ``!``, ``!=``,
+``!~`` and ``!in``.
+
+Negation that the compiler introduces on its own is not matched. A bare header
+test such as ``if inbound.req.X-Foo`` compiles to
+``cond %{CLIENT-HEADER:X-Foo} ="" [NOT]``, and denying ``NOT`` does not reject
+it — the policy governs what the source writes.
+
 Output
 ------
 

include/tscore/ink_atomic.h

@@ -69,6 +69,18 @@ ink_atomic_cas(T *mem, T prev, T next)
   return __sync_bool_compare_and_swap(mem, prev, next);
 }
 
+#if TS_HAS_128BIT_CAS_LIBATOMIC && !TS_HAS_128BIT_CAS
+// The 16-byte __sync builtins never lower to libatomic calls, so targets with
+// no inline 128-bit CAS (e.g. riscv64) must use the __atomic builtins instead.
+// libatomic may implement them with internal locks; see INK_QUEUE_LD.
+template <>
+inline bool
+ink_atomic_cas<__int128_t>(__int128_t *mem, __int128_t prev, __int128_t next)
+{
+  return __atomic_compare_exchange_n(mem, &prev, next, false, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST);
+}
+#endif
+
 // ink_atomic_increment(ptr, count)
 // Increment @ptr by @count, returning the previous value.
 template <typename Type, typename Amount>

include/tscore/ink_config.h.cmake.in

@@ -139,6 +139,7 @@ const int DEFAULT_STACKSIZE = @DEFAULT_STACK_SIZE@;
 
 /* Feature Flags */
 #cmakedefine01 TS_HAS_128BIT_CAS
+#cmakedefine01 TS_HAS_128BIT_CAS_LIBATOMIC
 #cmakedefine01 TS_HAS_BACKTRACE
 #cmakedefine01 TS_HAS_IN6_IS_ADDR_UNSPECIFIED
 #cmakedefine01 TS_HAS_IP_TOS

include/tscore/ink_queue.h

@@ -64,6 +64,12 @@ void ink_queue_load_64(void *dst, void *src);
     const volatile __int128_t iqld0 = 0;                                                           \
     *(__int128_t *)&(dst)           = __sync_val_compare_and_swap((__int128_t *)&(src), 0, iqld0); \
   } while (0)
+#elif TS_HAS_128BIT_CAS_LIBATOMIC
+// On targets with no inline 128-bit CAS (e.g. riscv64) libatomic may implement
+// the 16-byte __atomic builtins with internal locks. That is only correct
+// because every access to a shared head_p goes through INK_QUEUE_LD and
+// ink_atomic_cas, so all of them serialize on the same libatomic lock.
+#define INK_QUEUE_LD(dst, src) __atomic_load((__int128_t *)&(src), (__int128_t *)&(dst), __ATOMIC_SEQ_CST)
 #else
 #define INK_QUEUE_LD(dst, src) INK_QUEUE_LD64(dst, src)
 #endif
@@ -79,7 +85,7 @@ union head_p {
 #if (defined(__i386__) || defined(__arm__) || defined(__mips__)) && (SIZEOF_VOIDP == 4)
   typedef int32_t version_type;
   typedef int64_t data_type;
-#elif TS_HAS_128BIT_CAS
+#elif TS_HAS_128BIT_CAS || TS_HAS_128BIT_CAS_LIBATOMIC
   typedef int64_t    version_type;
   typedef __int128_t data_type;
 #else
@@ -124,7 +130,7 @@ union head_p {
 #define SET_FREELIST_POINTER_VERSION(_x, _p, _v) \
   (_x).s.pointer = _p;                           \
   (_x).s.version = _v
-#elif TS_HAS_128BIT_CAS
+#elif TS_HAS_128BIT_CAS || TS_HAS_128BIT_CAS_LIBATOMIC
 #define FREELIST_POINTER(_x) (_x).s.pointer
 #define FREELIST_VERSION(_x) (_x).s.version
 #define SET_FREELIST_POINTER_VERSION(_x, _p, _v) \
@@ -218,12 +224,7 @@ struct InkAtomicList {
   uint32_t    offset = 0;
 };
 
-#if !defined(INK_QUEUE_NT)
 #define INK_ATOMICLIST_EMPTY(_x) (!(TO_PTR(FREELIST_POINTER((_x.head)))))
-#else
-/* ink_queue_nt.c doesn't do the FROM/TO pointer swizzling */
-#define INK_ATOMICLIST_EMPTY(_x) (!((FREELIST_POINTER((_x.head)))))
-#endif
 
 // WARNING: the "name" string is not copied, it has to be a statically-stored constant string.
 //

plugins/cachekey/pattern.cc

@@ -152,7 +152,7 @@ Pattern::process(const String &subject, StringVector &result)
   } else {
     /* Replacement was not provided so return all capturing groups except the group zero. */
     StringVector captures;
-    if (capture(subject, captures)) {
+    if (capture(subject, captures) && !captures.empty()) {
       if (captures.size() == 1) {
         result.push_back(captures[0]);
       } else {
@@ -210,7 +210,7 @@ Pattern::capture(const String &subject, StringVector &result)
     return false;
   }
 
-  RegexMatches matches;
+  RegexMatches matches(_captureCount + 1);
   int          matchCount = _re.exec(subject, matches, RE_NOTEMPTY);
   if (matchCount < 0) {
     if (matchCount != RE_ERROR_NOMATCH) {
@@ -219,7 +219,7 @@ Pattern::capture(const String &subject, StringVector &result)
     return false;
   }
 
-  for (int i = 0; i < matchCount; i++) {
+  for (int i = 0; i < matches.size(); i++) {
     std::string_view capture = matches[i];
     String           dst(capture.data(), capture.length());
 
@@ -246,7 +246,7 @@ Pattern::replace(const String &subject, String &result)
     return false;
   }
 
-  RegexMatches matches;
+  RegexMatches matches(_captureCount + 1);
   int          matchCount = _re.exec(subject, matches, RE_NOTEMPTY);
   if (matchCount < 0) {
     if (matchCount != RE_ERROR_NOMATCH) {
@@ -255,18 +255,11 @@ Pattern::replace(const String &subject, String &result)
     return false;
   }
 
-  /* Verify the replacement has the right number of matching groups */
-  for (int i = 0; i < _tokenCount; i++) {
-    if (_tokens[i] >= matchCount) {
-      CacheKeyError("invalid reference in replacement string: $%d", _tokens[i]);
-      return false;
-    }
-  }
-
   int previous = 0;
   for (int i = 0; i < _tokenCount; i++) {
-    int              replIndex = _tokens[i];
-    std::string_view capture   = matches[replIndex];
+    int replIndex = _tokens[i];
+    // Trailing optional groups may not participate in this match.
+    std::string_view capture = (replIndex < matches.size()) ? matches[replIndex] : std::string_view{""};
 
     String src(_replacement, _tokenOffset[i], 2);
     String dst(capture.data(), capture.length());
@@ -304,6 +297,12 @@ Pattern::compile()
     return false;
   }
 
+  _captureCount = _re.get_capture_count();
+  if (_captureCount < 0) {
+    CacheKeyError("failed to get capture count for pattern '%s'", _pattern.c_str());
+    return false;
+  }
+
   if (!_replace) {
     /* No replacement necessary - we are done. */
     return true;
@@ -336,6 +335,16 @@ Pattern::compile()
     }
   }
 
+  if (success) {
+    for (int i = 0; i < _tokenCount; i++) {
+      if (_tokens[i] > _captureCount) {
+        CacheKeyError("invalid reference $%d in replacement '%s': pattern defines only %d group(s)", _tokens[i],
+                      _replacement.c_str(), _captureCount);
+        return false;
+      }
+    }
+  }
+
   return success;
 }
 

plugins/cachekey/pattern.h

@@ -50,7 +50,8 @@ class Pattern
 private:
   bool compile();
 
-  Regex _re; /**< @brief Regex compiled object */
+  Regex   _re;               /**< @brief Regex compiled object */
+  int32_t _captureCount = 0; ///< Number of capture groups defined by the compiled pattern.
 
   String _pattern; /**< @brief Regex pattern string, containing regex patterns and capturing groups. */
   String

plugins/cachekey/unit_tests/pattern_test.cc

@@ -202,13 +202,47 @@ TEST_CASE("Pattern compile and match behavior", "[cachekey][pattern]")
     CHECK(res == "num=123;");
   }
 
-  SECTION("Replacement with invalid group reference")
+  SECTION("Replacement with invalid group reference fails at initialization")
   {
     Pattern p;
-    REQUIRE(p.init("(\\w+)", "$5", true)); // only 2 groups (0 and 1)
+
+    CHECK_FALSE(p.init("(\\w+)", "$5", true));
+    CHECK_FALSE(p.init("(a)(b)?", "$3", true));
+    CHECK_FALSE(p.init("literal", "$1", true));
+  }
+
+  SECTION("Replacement with optional capture groups")
+  {
+    Pattern p;
+
+    REQUIRE(p.init("^(a)(b)?(c)?$", "$1-$2-$3", true));
+    for (const auto &[subject, expected] : {
+           std::pair{"a",   "a--"  },
+           {"ab",  "a-b-" },
+           {"ac",  "a--c" },
+           {"abc", "a-b-c"}
+    }) {
+      String res;
+
+      REQUIRE(p.replace(subject, res));
+      CHECK(res == expected);
+    }
+  }
+
+  SECTION("Capture and replacement beyond the inline match buffer")
+  {
+    Pattern      p;
+    StringVector result;
+
+    REQUIRE(p.init("(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)"));
+    REQUIRE(p.process("abcdefghijkl", result));
+    CHECK(result == StringVector{"a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l"});
+
+    REQUIRE(p.init("(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)", "$9$1", true));
     String res;
-    // Should fail because $5 doesn't exist
-    CHECK(p.replace("test", res) == false);
+
+    REQUIRE(p.replace("abcdefghijkl", res));
+    CHECK(res == "ia");
   }
 
   SECTION("process() method - capture mode (no replacement)")

src/iocore/cache/CacheProcessor.cc

@@ -249,11 +249,14 @@ CacheProcessor::start_internal(int flags)
 #endif
     int64_t blocks = span->blocks;
 
-    if (fd < 0 && (opts & O_CREAT)) { // Try without O_DIRECT if this is a file on filesystem, e.g. tmpfs.
+    // Try again without O_DIRECT (and O_DSYNC) for a span on a file system that does not support it, e.g. tmpfs. This retry
+    // applies to an explicit file span as much as to a directory span: the file system decides whether direct I/O is usable,
+    // not the form the span was written in. O_CREAT is carried over only when it was requested above.
+    if (fd < 0) {
 #ifdef AIO_FAULT_INJECTION
-      fd = aioFaultInjection.open(paths[gndisks], DEFAULT_CACHE_OPTIONS | O_CREAT, 0644);
+      fd = aioFaultInjection.open(paths[gndisks], DEFAULT_CACHE_OPTIONS | (opts & O_CREAT), 0644);
 #else
-      fd = open(paths[gndisks], DEFAULT_CACHE_OPTIONS | O_CREAT, 0644);
+      fd = open(paths[gndisks], DEFAULT_CACHE_OPTIONS | (opts & O_CREAT), 0644);
 #endif
     }