[ConstraintElim] Derive an unsigned IV bound from a signed relational latch. (#222762)
For a known non-negative backedge (either via isKnownNonNegative or
because the increment is increasing), 0 <=s PN <= B holds and implies
that B is non-negative as well.
Use that to translate a signed condition to the equivalent unsigned one.
Note that the general signed->unsigned rewrite cannot catch this,
because the precondition also needs rewriting to unsigned.
No llvm-opt-benchmark-nightly impact, but it can help remove runtime
checks generated by sanitizers or Swift code. An end-to-end C example is
https://clang.godbolt.org/z/vbd91MjaM.
Alive2 Proof: https://alive2.llvm.org/ce/z/G3Mv7t
PR: https://github.com/llvm/llvm-project/pull/222762
[mlir][vector] Don't fold in_bounds for negative constant indices (#219681)
`isInBounds` checked only that the transfer *ends* inside the source:
return cstOp.value() + vectorSize <= sourceSize;
The `in_bounds` attribute promises more than that. Its definition in
VectorOps.td says accesses "(including the starting point)" may run
out-of-bounds when it is "false", so setting it to "true" is a claim
about the start of the transfer as well as its end.
With a negative constant index the two disagree. For
vector.transfer_read %m[-1] : memref<8xf32>, vector<4xf32>
`-1 + 4 <= 8` holds, so the fold set `in_bounds = [true]`, even though
element -1 is read from outside `%m`.
The same expression also overflows for a large enough index: at `index =
[13 lines not shown]
[ASan] Convert pointer-pair operands based on type (#218494)
`CreatePointerCast` was being called on everything without checking what
it actually is, so if the operand came from ptrtoint ... to i32 it just
crashes (its not a pointer).
now it check the type first - pointers get pointer-cast, ints get
zext/trunc'd to intptr width.
Fixes #217544
also edited regression tests for this
pci_resource: use existing BARs even if mem/io space is left disabled
It's possible that firmware assigned resources to a device and left
memory / io space accesses disabled. Let's assume if we see a non-zero
address in a BAR that it was assigned by firmware.
Should help PR# kern/60427 and kern/60463
[Mips] Handle division by zero trap on MIPS1 (#201133)
LLVM currently emits the `teq` instruction for every arch version, but
`teq` is unsupported on MIPS1.
This special cases MIPS1 so that `bne(z)` and `break` are emitted
instead.
Compared to https://github.com/llvm/llvm-project/pull/81311, this should
also handle liveness as far as I can tell.
I didn't want to add another bool to the argument list so I combined
`IsMicroMips` and what was supposed to be `IsMips1` into an enum, which
feels much nicer in this case.
Besides that and the main change, I also changed the `hasSideEffects`
bit for `PseudoSDIV` and `PseudoUDIV`,
which allows the delay slot to be usefully filled - well, at least with
`-O1`+. This seems to be in line with what GCC does:
https://godbolt.org/z/zqcG5ha35
Tested using clang directly and through Zig's LLVM backend.
[2 lines not shown]
LinuxKPI: Add dma_length field to struct scatterlist
On Linux `dma_length` field of `struct scatterlist` is present on the
arches where DMA mapping code is able to coalesce adjacent segments
of physical address space. It contains total length of coalesced
segments while `length` field contains non-coalesced length of each
segment. On other arches `dma_length` is aliased to `length` field with
`sg_dma_len` macro. As FreeBSD does not merge scatterlist segments it
do not have `dma_length` field. It is appered that at least i915kms
driver depends on existence of `dma_length` field.
Add the field and disable it by default. To enable add to Makefile
.if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64" || \\
${MACHINE_CPUARCH} == "aarch64" || ${MACHINE_CPUARCH} == "powerpc"
CFLAGS+= -DCONFIG_NEED_SG_DMA_LENGTH
.endif
Reported by: Ryan Fahy
[4 lines not shown]
LinuxKPI: Add dma_length field to struct scatterlist
On Linux `dma_length` field of `struct scatterlist` is present on the
arches where DMA mapping code is able to coalesce adjacent segments
of physical address space. It contains total length of coalesced
segments while `length` field contains non-coalesced length of each
segment. On other arches `dma_length` is aliased to `length` field with
`sg_dma_len` macro. As FreeBSD does not merge scatterlist segments it
do not have `dma_length` field. It is appered that at least i915kms
driver depends on existence of `dma_length` field.
Add the field and disable it by default. To enable add to Makefile
.if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64" || \\
${MACHINE_CPUARCH} == "aarch64" || ${MACHINE_CPUARCH} == "powerpc"
CFLAGS+= -DCONFIG_NEED_SG_DMA_LENGTH
.endif
Reported by: Ryan Fahy
[4 lines not shown]
[AMDGPU] Fix MAI hazard scan missing 19-instruction-old hazards (#222040)
The scan only looked back 19 instructions, but gfx950 can need a gap of
20 after some MFMAs
A hazard exactly 19 instructions back was missed, so no wait was
inserted
[clang][SPIR-V][AMDGPU] Fix variadic aggregate ABI classification for AMDGCN (#216326)
Mirror AMDGPUABIInfo fixed/variadic split
AMDGCNSPIRVABIInfo::classifyArgumentType did not distinguish fixed from
variadic arguments, so aggregates passed through `...` were
misclassified as indirect byref instead of direct
Merge misc regression fixes that seem to have fallen through the cracks
Thorsten continues to track regressions, and reporting on known issues
with fixes that don't seem to make any progress.
I'm going to do an rc3 release later today - let's not keep these known
issues pending for yet another rc for no obvious reason.
Reported-by: Thorsten Leemhuis <regressions at leemhuis.info>
Link: https://lore.kernel.org/all/46403cf8-9a81-4596-87eb-dde58ae4c5db@leemhuis.info/
* regressions:
media: ipu-bridge: do not use the CVS device lookup for IVSC
wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe
wifi: mt76: mt7921: skip unknown CLC firmware records
media: ipu-bridge: do not use the CVS device lookup for IVSC
Since commit c6b1b34b5090 ("media: pci: intel: Add CVS support for IPU
bridge driver") the internal camera no longer works on laptops where the
sensor sits behind an IVSC, for example a Dell XPS 16 9640 (IPU6,
INTC10CF, ov02c10):
intel-ipu6 0000:00:05.0: Found supported sensor OVTI02C1:00
intel-ipu6 0000:00:05.0: Connected 1 cameras
ivsc_csi intel_vsc-92335fcf-3203-4472-af93-7b4453ac29da: mei-csi probed
without device fwnode!
No sensor subdevice is registered, the media graph has no sensor entity
and userspace finds no camera at all.
ipu_bridge_get_ivsc_csi_dev() first looks for the platform device named
"intel_vsc" and returns its mei-csi child. That device is created by
mei_vsc, which on this machine only appears once the LJCA USB bridge and
its SPI controller have probed, about a second after the IPU6 probe that
[36 lines not shown]
wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe
Some laptops carry a MediaTek power table in their firmware, and the
driver reads it to set a transmit limit for each frequency range. It
only fills in the ranges themselves when it registers the device.
The startup step that does this existed already, but it never programmed
anything. Two recent commits made it run a regulatory update instead,
which sets the limits on the way through, long before registration.
As a result, on a machine that has the table the driver reads through an
empty pointer and the interface never appears:
BUG: kernel NULL pointer dereference, address: 0000000000000004
RIP: 0010:mt792x_init_acpi_sar_power
Call Trace:
mt7921_set_tx_sar_pwr
mt7921_mcu_regd_update
mt7921_regd_update
[15 lines not shown]
wifi: mt76: mt7921: skip unknown CLC firmware records
Treat an out-of-range CLC index as newer firmware rather than a
malformed image. linux-firmware 20260810 ships MT7922 records with
idx 3, and rejecting them made mt7921e fail to probe.
Keep the record-length checks, and report those as errors so a
truncated table is visible instead of a silent retry loop.
Fixes: 9417c5818a01 ("wifi: mt76: mt7921: validate CLC firmware records")
Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov at gmail.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848 at gmail.com>
Reviewed-by: Junjie Cao <junjie.cao at intel.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov at gmail.com>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
[MIRParser] Reject a one-element fixed-length vector type (#213290)
MIParser accepts `<1 x sN>` and then asserts while building the LLT, so
llc aborts during parsing instead of reporting a parse error:
```
Assertion `!EC.isScalar() && "invalid number of vector elements"' failed.
```
LLT has no one-element fixed-length vector. `getLLTForType`,
`getLLTForMVT` and
`LLT::changeElementCount` all map a one-element `ElementCount` to the
element
type through `LLT::scalarOrVector`, nothing calls `LLT::fixed_vector(1,
...)`,
and no in-tree .mir test uses the syntax. `verifyVectorElementCount`
already rejects 0 and anything above 2^16, so 1 was the remaining hole; it now
gets the same diagnostic instead of aborting the parser.
[3 lines not shown]
Allow man.cgi(8) to cope with compressed manual pages.
While we don't do that on man.openbsd.org and while i doubt whether
saving a small amount of disk space on a web server is worth consuming
additional CPU time over and over again when the page is served,
some public servers on the Internet run the mandoc man.gi(8) and
serve from gzipped pages, and it's surprisingly easy to implement
because the internal API function mparse_open() already encapsulates
the required logic.
Based on a patch from Duncan Overbruck <duncaen at voidlinux.org>,
tweaked by me to correctly free the mchars and mparse objects
in the error path.
Merge tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
for 'unnecessary_transmutes', which is unknown in older compilers
- Clean 'clippy::as_underscore' lints in generated code by the new
'bindgen' 0.73.0+ releases
- Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
1.100.0 (expected 2026-11-12)
'kernel' crate:
- 'num' module: fix soundness issue in 'Bounded' by sealing the
'Integer' trait
[16 lines not shown]
[AggressiveInstCombine] Fix terminology in a few comments (NFC) (#222327)
Fix the comments (and a debug print) that say "dominated by trunc"
rather than "post-dominated".
Also fixes a Doxygen syntax (use \p instead of /p) and fix
capitalization in the middle of a sentence.
