[mlir][ArmSVE] Scale the scalable dim index in LegalizeTransferRead (#239583)
`LegalizeTransferRead` collapses the trailing memref dims, from the
scalable one onwards, and reads from the collapsed memref. The index of
the scalable dim then indexes the collapsed dim, but it was kept as is,
so
```mlir
%A = vector.transfer_read %M[%i, %j, %k, %c0], %pad {in_bounds = [true, true]} : memref<?x?x?x8xi8>, vector<[4]x8xi8>
```
read from `%k` instead of `%k * 8`:
```mlir
%collapse_shape = memref.collapse_shape %M [[0], [1], [2, 3]] : memref<?x?x?x8xi8> into memref<?x?x?xi8>
%0 = vector.transfer_read %collapse_shape[%i, %j, %k], %pad {in_bounds = [true]} : memref<?x?x?xi8>, vector<[32]xi8>
```
This patch scales that index by the size of the dims collapsed into it.
[11 lines not shown]
[compiler-rt] mark padding [[maybe_unused]] (#241052)
-Wunused-private-field will soon be able to flag fields in instantiated
class templates. Land this in preparation.
Link: #237374
[libcxx] mark intentionally unused fields [[maybe_unused]] (#241054)
-Wunused-private-field will soon be able to flag fields in instantiated
class templates. Land this in preparation.
Link: #237374
bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
sysvsem: Plug another place where we leak __sem_base to userspace
Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.
Reviewed by: imp, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61396
[AMDGPU] IGLP: fix two-regions test in builds without assertions (#241355)
Remove wrong undef flags and replace -verfiy-mished so that invalid live
ranges aren't "fixed" by it in assertion builds.
Fixes buildbot issue for
https://github.com/llvm/llvm-project/pull/237774
Claude assisted with this patch.
[AArch64] Use SVE ldN for fixed length deinterleave (#241218)
When fixed length vectors uses SVE, 64 bit vector type missed the
deinterleave combine to form ldN.
[mlir][nfc] Improve consistency in test names (#241374)
Use "masked" for `vector.mask %mask {vector.xfer_op}` and "with_mask"
for `vector.xfer_op %mask`.
Attributor: Hash all bits of the abstract attribute map keys (#241082)
The AA IDs are adjacent bytes and the positions of a value only differ
in the low bits, which the default hashes mostly ignore, so many AAMap
keys collide. Hash the full key instead.
attributor-light instruction counts (callgrind): -0.6% to -4.3%, full
attributor -0.5% to -1.5%. CTMark (-attributor-enable=light): O3
-0.01%, ThinLTO -0.03%.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
