[SystemZ] Define isTypeDesirableForOp to use in DAGCombine (#239841)
SystemZ widens vector integer sources to the fp element width in its
combine and the generic narrowing undid it alternating forever on
<4 x i16> and masked <4 x i64> sources of <4 x double>.
Consult isTypeDesirableForOp before narrowing, passing the node rather
than the opcode so the target can see the fp result type next to the
candidate operand type. SystemZ rejects vector operands narrower than
the fp elements.
Fixes #239444
[AMDGPU] Price misaligned flat and LDS accesses with the LDS misaligned bug
In WGP mode on subtargets with the LDS misaligned bug, a flat access is
split into pieces no wider than its alignment and no narrower than 4
bytes, and an LDS access aligned below 4 bytes uses 8-byte pieces as one
aligned to 4 does.
[AMDGPU] Price buffer fat pointer memory operations
Price buffer fat pointer accesses as global accesses, except that an
aligned load is not widened and a vector of odd width elements is not
split element by element. Without relaxed buffer bounds checking, a
vector of elements that are a multiple of 32 bits wide is accessed in
pieces no wider than its alignment and no narrower than 4 bytes, and a
vector of other byte-sized or power of 2 wide elements in pieces of the
largest power of 2 bytes that divides the element size. The width comes
from buffer fat pointer lowering, which now exposes it. When the pointer
is a buffer resource plus a constant offset, the offset and a constant
number of records give the same bounds facts lowering uses to access it
in wider pieces.
[AMDGPU] Price constant address space memory operations (#238840)
Price constant address space accesses as global accesses, except for
loads selected to scalar loads of up to 64 bytes. These are loads from
the 32-bit constant address space, and loads from the constant address
space whose pointer is an argument passed in SGPRs or a constant, plus
constant offsets, both aligned to 4 bytes or to their size. A scalar
load is widened as its lowering does. An integer whose size is not a
multiple of 4 bytes is loaded as whole dwords, plus a byte load when its
size is 7 modulo 8, since the last byte of such a remainder is left out
of the scalar load. A type with no legal dword vector equivalent is
split into the largest power of 2 pieces that fit, and once the
remainder fits in the alignment it is widened to a power of 2 piece of
up to the alignment, at most 8 bytes for byte vectors. A 3-dword
remainder of a legal dword vector takes a fourth dword when aligned to 8
on a subtarget without scalar dwordx3 loads.
Assisted-By: Claude Code Opus 5
[llvm-strings] Initialise UCh. (#240607)
Although mbrtoc32() will only return 1 if UCh has been written to, that
write comes from an uninstrumented libc and triggers an MSAN false
positive. Explicitly initialise UCh from the LLVM side to suppress this.
[VPlan] Hoist invariant base of pointer adds in runtime checks. (#240542)
When expanding a variant pointer add for the runtime checks of an inner
loop in a loop nest, operands invariant in the outer loop were expanded
individually and added to the pointer inside the outer loop.
If the pointer itself is invariant in the outer loop, use the sum of all
invariant operands as ptradd base instead, so it is expanded in IR and
hoisted out of the outer loop whole. The sum of the variant operands is
expanded as offset, as for integer adds.
[InferAddressSpaces] Don't replace uses in other functions
`performPointerReplacement` visits every use of a value in the postorder
list. When the value is a constant expression, some of these uses can be
in other functions. It already skipped such uses, but only after
`replaceIfSimplePointerUse`, so when the pass ran on one function, it
could still rewrite a load, store, `atomicrmw`, or `cmpxchg` in another
function, even in an `optnone` function.
This PR skips a use in another function before any replacement, like
#70611 did for the other users of a constant.
This PR was assisted by AI but I reviewed all the changes.
link_elf: bounds-check the DT_HASH offset
parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header. Reject
the object with ENOEXEC when the header does not fit in the image.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61323
link_elf_obj: validate section name offsets
A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read. Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61338
link_elf_obj: validate symbol name offsets
A symbol name offset (st_name) indexes the string table in several
places without being checked against ddbstrcnt, so a corrupt object
causes an out-of-bounds read. Check that the string table is
NUL-terminated and that every st_name lies within it, in both the
preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61322
link_elf_obj: bounds-check e_shstrndx in link_elf_load_file()
e_shstrndx is used to index the section header array after only being
checked against zero, so a malformed object can make the linker read up
to about 64K entries past the end of shdr[]. Reject such a file with
ENOEXEC, as link_elf_link_preload() already does.
Reported by: llm-postcr
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61321
[mlir][XeGPU] Retry smaller inst_data when picking subgroup layouts (#239888)
Subgroup layout propagation always used the largest hardware block as
`inst_data`. When each subgroup's tile is smaller than that block, no
layout was found and propagation failed. For example, `64x16xf32` over
32 subgroups gives each subgroup `2x16`, which is smaller than the
`8x16` block.
This PR retries with smaller blocks until a subgroup layout fits:
- store_nd / prefetch_nd: try smaller block sizes.
- dpas / dpas_mx: try smaller M.
The largest block is still tried first, so existing results don't
change.
assisted-by-claude
---------
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[MC][MachO] Add an option to relocate cross-section offsets in DWARF (#239793)
Mach-O objects store references from one DWARF section into another as
bare offsets rather than relocations. For comparison in ELF, DWARF
references are relocations against sections that start at address 0.
Because of this Mach-O DWARF sections cannot be concatenated by tools
such as ld -r. However, this would be useful for some niche use-cases
such as doing an incremental (ld -r) link and then creating a static
archive that is then distributed to another machine.
This patch adds MCTargetOptions::MachORelocatableDwarf and a
-macho-relocatable-dwarf flag, which sets
DwarfUsesRelocationsAcrossSections for Darwin targets. When it is set,
every __DWARF section is also assigned address 0, like in ELF.
Assisted-by: Claude
sysutils/bsdisks: refresh TimeMediaDetected on media change
TimeMediaDetected was only set when the drive appeared, so a card
inserted into a card reader that was already plugged in, or a disc
inserted into an optical drive, got a stale time and gvfs would not
automount it. Update it on devd MEDIACHANGE and send
PropertiesChanged so gvfs picks up the new value.
Use read-only accessors for TimeDetected and TimeMediaDetected,
matching the other Drive properties.
Revert "[test][llvm-strings] Use printf for interpreting octal of echo -e" (#240613)
Reverts llvm/llvm-project#240529
Apparently this breaks things for z/OS. Not that it's easy to tell given
there's no upstream CI for z/OS as far as I can tell.
Co-authored-by: Jackson Stogel <jtstogel at gmail.com>
SystemZ: Lower sub-word atomicrmw during type legalization (#238532)
Produce the ATOMIC_LOADW_* nodes when replacing the illegal i8/i16
results, instead of custom lowering the promoted node later. This
removes the no-op custom type legalization case.
Constants are now any-extended, so one test materializes an immediate
with llill instead of lhi.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
[LV] Expand alias-mask pointer bounds after the SCEV checks. (#240556)
materializeAliasMask expanded the diff-check pointer bounds via
VPExpandSCEVRecipes in the entry block, before the SCEV checks. The
bounds come from LAA's SCEVs, which are computed under LAA's predicates
(e.g. versioned strides), so they are only valid if the predicates hold.
For example a bound could become%n /u (%y + 1) after versioning
%stride == 1, which divides by zero for %y == -1 and %stride != 1,
while the original loop is well defined.
Expand the bounds directly in the alias-mask check block using
VPSCEVExpander, which is dominated by the SCEV checks.
[Clang][OBT] Diagnose overflow handlers in local class member functions
The overflow handler diagnostics skipped any body finished while another
function scope was active, so that a lambda is diagnosed with its
enclosing function. That also skipped member functions of local classes,
which the enclosing walk does not visit, so they were never diagnosed.
Skip only nested lambdas. A local class member function is a separate
function, so it can warn under -Woverflow-behavior-no-handler but never
under -Woverflow-behavior-unreachable-handler.
Also inline the three single-use diagnostic groups, and use %enum_select
for the lambda or block in -Woverflow-behavior-unreachable-handler.
Signed-off-by: Justin Stitt <justinstitt at google.com>
[libc][stdfix][NFC] Use cpp::numeric_limits<T>::digits in divifx (#239900)
Use `cpp::numeric_limits<T>::digits` in `divifx` to count value bits
instead of `sizeof(IntType) * 8 - cpp::is_signed_v<IntType>`.
Also compare `INTERMEDIATE_BITS` against
`cpp::numeric_limits<int64_t>::digits` (63) instead of `64` for signed
types, since `INTERMEDIATE_BITS` excludes the sign bit.
Follows
https://github.com/llvm/llvm-project/pull/235602#issuecomment-6417638445.
[libc][math][c++23] Add log10p1bf16 math function (#235343)
This PR adds the `log10p1bf16` math function to LLVM libc for the
`bfloat16` type. It computes `log10(1 + x)` and handles special cases
like NaN, infinity, zero, and the domain boundary at `x = -1`.
The implementation uses a polynomial approximation for small inputs and
range reduction with a lookup table for other inputs. Special cases are
handled to maintain the expected floating-point behavior, including
exception behavior.
Added unit tests for accuracy, special values, and exception handling,
along with smoke tests. Updated the relevant libc entrypoint lists,
CMake files, and Bazel build files to integrate the function into both
build systems.
Validated the implementation using the available CMake and Bazel build
and test targets.
[4 lines not shown]
zdb: borrow only the length read in the --anyraid-map dump
vdev_anyraid_read_map() reads each tile map chunk at its rounded
length, not as a full 16 MiB buffer, but print_anyraid_mapping()
borrows and returns SPA_MAXBLOCKSIZE bytes of each buffer. Debug
builds abort on 'zdb --anyraid-map -vv' and higher: "VERIFY3U(
abd->abd_size, >=, n) failed (512 >= 16777216)" in abd_borrow_buf().
Borrow and return the size of each buffer.
Also free the two arrays that zdb_print_anyraid_tile_layout()
allocates for its separator lines, which valgrind reports as lost
with any --anyraid-map -v level.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Paul Dagnelie <paul.dagnelie at klarasystems.com>
Signed-off-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Closes #19728
anyraid: write the last tile's entries when a map chunk fills
vdev_anyraid_write_map_sync() issues each 16 MiB chunk of the tile map
as soon as an entry fills it, but when that entry belongs to the last
tile it stops and leaves the chunk to the final write. If the entry
was the skip entry before that tile, or the location of one of its
copies but not the last, the remaining entries of the tile are never
written: once the vdev is opened again, the map has lost that tile or
some of its copies.
Stop only when the entry that filled the chunk is the last one, and
otherwise issue the chunk and go on. Found from reading, as was the
read of a full last chunk: a chunk holds 4194304 entries, and this was
not reproduced.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Paul Dagnelie <paul.dagnelie at klarasystems.com>
Signed-off-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Closes #19728
