[compiler-rt] Add Device AddressSanitizer runtime
Host and device runtime for dasan, built on the sanitizer_common offload
layer. The common layer gains the HSA pieces dasan needs: pool and agent
queries, virtual memory reservation and sharing, code object enumeration,
cache publication, and device symbolization. The runtime keeps the
allocator, global aliasing, and report formatting. Each device begins on
its own metadata granule, so an entry load stays on the device that owns
the object.
The runtime follows ubsan's offload shape: HSA interceptors that report HSA
as absent when it is not loaded, a dasan-preinit archive, static and shared
runtimes, a receive-only RPC handler on SANITIZER_OFFLOAD_DASAN, and lit
tests on the common GPU substitutions. The report handlers elect the first
active lane, which is the first failing one, and take their return address
as the location of the access. Host checks call __dasan_report_load and
__dasan_report_store and take the caller's frame.
Fine-grain pools are placed only when the AMD extension honors pool flags
[5 lines not shown]
[mlir][SPIR-V] Fix SPIRVToLLVM crash on spirv.mlir.loop with results (#238895)
Loop results were never passed to the code after the loop, so conversion
crashed
AMDGPU: Promote 16-bit arguments to i32 in the calling convention
Promote i16, f16 and bf16 arguments to i32 in the calling convention
when they are inreg or real true16 is not used, instead of special
casing the copy type in LowerFormalArguments. The manual call lowering
code can now rely on LocVT / ArgVT.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[CIR] Report side effects of volatile loads and memory asm operands
cir.load, cir.get_bitfield and cir.matrix.column_major_load declared only
a read of their address, so dead code elimination erased them when the
result was unused, even when the load was volatile or atomic. A cir.asm
with a memory operand such as "=*m" and no result was erased the same
way. A volatile or atomic load now also reports unknown read and write
effects, as the LLVM dialect does, and an inline asm reports a read and
a write of each memory operand.
Assisted-by: Claude Code (claude-opus-5-5).
Support: Only use aligned allocation in allocate_buffer when needed (#242674)
allocate_buffer always used aligned operator new, which is much slower
than plain operator new. Plain operator new already guarantees
__STDCPP_DEFAULT_NEW_ALIGNMENT__, which covers most callers, such as
DenseMap. Only use the aligned form for larger alignments.
CTMark instructions:u: O3 -0.13%, ThinLTO -0.12%.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[Clang] Add -fsanitize=daddress for Device AddressSanitizer
Wire the sanitizer through the driver, codegen, and preprocessor. Emit
sanitize_device_address, run the dasan pass, and link the dasan runtime
on AMDGPU offload and supported Linux hosts.
RFC: https://discourse.llvm.org/t/rfc-add-a-device-address-sanitizer-for-gpus-dasan/92710
[CIR] Make cir-canonicalize a full canonicalizer
cir-canonicalize applied the CIR canonicalization patterns and folders
only to a hand-written list of operations. It now builds the pattern set
once in initialize() and runs the greedy driver over every operation, so
every pattern and folder applies everywhere. Dead code elimination is
disabled: CIR stays close to the source, so unused locals and ignored
expressions are kept as in classic codegen, and only the inputs of a
folded operation can be left unused. Empty scopes and switches were
removed only because they were dead, so they get explicit
canonicalization patterns.
The pass uses the multi-op driver because the region driver always
erases blocks without a CFG predecessor, and a block that starts with
cir.label is reached only through cir.goto until the goto solver runs.
Region simplification stays off for the same reason. The new
test-convergence option fails the pass when the driver does not reach a
fixpoint, as in the upstream canonicalizer.
Assisted-by: Claude Code (claude-opus-5-5).
[flang][OpenMP] Move OmpAttributeVisitor members out of line, NFC (#242658)
The function body was getting difficult to read with many long functions
defined inline.
Co-Authored-By: Claude Opus 5 (1M context) <noreply at anthropic.com>
[LLVM] Add DeviceAddressSanitizer instrumentation pass
Instrument loads, stores, and memory intrinsics against dasan's
size-class metadata. The handler locates the access by its return
address, so each check calls a report of its own that is never merged,
inlined, or tail called. On AMDGPU, keep the dispatch pointer that
shared memory checks read, and preserve the __dasan_ entry points.
AMDGPU keeps one decode per inbounds root and selects the zero word for
an outside pointer, so the load can be hoisted and the wave does not
branch. Elsewhere an outside pointer is the common case, so membership
is a branch and the decode is its cold side. Global relocation defaults
to AMDGPU and follows -dasan-instrument-globals when set. The metadata
pointer uses the data layout's default globals address space.
RFC: https://discourse.llvm.org/t/rfc-add-a-device-address-sanitizer-for-gpus-dasan/92710
[llvm-objdump] Parse -mllvm options into a context (#242688)
Parse -M att/intel and -mllvm into a cl::LibraryOptionsContext instead
of the global option values, otherwise --x86-asm-syntax=att will become
unrecognized when we reject library options in the legacy
cl::ParseCommandLineOptions.
AMDGPU: Copy 16-bit arguments in 32-bit registers as i32 and truncate
A 16-bit argument passed in an SGPR, or in a VGPR without real true16,
lives in the low half of a full 32-bit register. Copy the argument as
i32 and truncate it rather than reading it with a 16-bit CopyFromReg of
the 32-bit live-in register. With real true16 a 16-bit VGPR value has its
own register class, so it is still copied directly.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[MachineLICM] Track peak register pressure when hoisting
The pressure check in MachineLICM only looks at the estimates saved in
BackTrace. These record pressure at block boundaries, so they can miss an
earlier peak in the current BB or an ancestor BB. If pressure falls before the
candidate, the check can allow it to move even though its def then needs to stay
live across that earlier peak. This can push pressure beyond the limit and cause
spills.
This PR adds PeakPressure alongside RegPressure and saves the previous peak with
the existing boundary estimate in BackTrace. The pressure check considers the
current BB's peak and both saved estimates. Normal hoists adjust the current and
saved peaks, and scope exit restores the previous peak. Preheader scanning skips
peak updates and seeds the starting pressure from its final estimate.
Fixes LCOMPILER-3233.
This PR was assisted by AI but I reviewed all the changes.
[CodeGen] Honor -stress-regalloc in register pressure limits
computePSetLimit falls back to the target pressure limit when the reserved
register weight is at least that limit. This avoids underflow, but loses
allocation restrictions such as -stress-regalloc.
Bound this fallback by the remaining allocatable register weight. The
allocatable count already includes the stress limit. Keep the existing
subtraction when it leaves a positive limit and the zero-allocation
fallback.
Add an AMDGPU MIR test for stress limits that block or allow hoisting.
Add an X86 MIR test to check that a stress value which clips no allocation
order preserves the normal pressure adjustment and hoisting result.
Update the affected AMDGPU stress test.
Validation: all 51 stress-regalloc tests pass with MachineLICM unchanged.
With the stacked MachineLICM change, the full LLVM suite has 80,791 passes
and no unexpected failures.
[2 lines not shown]
[LFI][AArch64] Do not save or restore LFI reserved registers (#241545)
Marks LFI's reserved registers using `ReserveXRegister` so that they are
omitted by calling conventions and builtins like
`__builtin_unwind_init`. Also uses `ReserveLRForRA` to mark `x30` as
reserved.
[llubi] Return poison for OOB base ptr for GEP inbounds (#242603)
Before this patch, llubi would not return poison for a getelementptr
inbounds instruction that ended up back inside the original allocation
because we never checked whether the base pointer was in bounds.
Fixes #235438
Assisted-By: LLM
Support: Only use aligned allocation in allocate_buffer when needed
allocate_buffer always used aligned operator new, which is much slower
than plain operator new. Plain operator new already guarantees
__STDCPP_DEFAULT_NEW_ALIGNMENT__, which covers most callers, such as
DenseMap. Only use the aligned form for larger alignments.
CTMark instructions:u: O3 -0.13%, ThinLTO -0.12%.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
Verifier: Check each string function attribute once
verifyFunctionAttrs looked up about 35 string attributes by name for
every function and call site. Iterate over the string attributes that
are present instead, and only look up the attributes they depend on.
Whole O3 instructions in opt:
kimwitu++ k.bc -1.03%, SPASS cnf.bc -0.34%, sqlite3 -0.12%.
CTMark instructions:u: ThinLTO -0.05%.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[RISCV] Mark that the register spill libcall clobbers X6. (#238079)
I've added a test, but it was already fixed by clobbering x6-x7
on tail calls for the restore.
Fixes #235697
[llc,llvm-mc] Remove redundant MCOptions.LibraryOptions assignments. NFC (#242672)
mc::getMCTargetOptions and codegen::getTargetOptions (#242671) now set
MCOptions.LibraryOptions to the context they read.
[MC] Set MCTargetOptions::LibraryOptions in getMCTargetOptions (#242671)
Set the `LibraryOptions` pointer in getMCTargetOptions, so that tools
like llc/llvm-mc can stop setting it by hand. With this change,
`lli -jit-kind=mcjit -x86-indirect-branch-tracking` emits no endbr64.
