Merge tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Last set of fixes, mostly amdgpu, some i915 and xe.
I think the dma-buf revert is probably the most important: while it is
technically correct the fallout from it means we shouldn't enable
DMABUF_DEBUG like that yet, and fix the fallout first.
Summary:
MAINTAINERS update
dma-buf:
- revert dma-debug y on debug kernel due to msm interaction
core:
- fix drm_exec prelocked object interaction
[60 lines not shown]
Merge tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Here are the (hopefully) last bits for 7.3.
At this time, all changes are small and device-specific ASoC fixes.
Not super-urgent, but should be fairly safe to take"
* tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: amd: yc: disable MSI on resume
ASoC: nau8822: Fix the 128x oversampling switch bits
ASoC: wm8978: Fix the 128x oversampling switch bits
ASoC: max98371: Fix the Speaker DHT Min Volume bits
ASoC: pcm3168a: Fix the DAC zero flag polarity bit
ASoC: cs42l52: Fix the NG Type Switch bit
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
ASoC: stm32: spdifrx: fix synchronization state check
ASoC: Intel: avs: Reset the stream unless it is already prepared
ASoC: SOF: sof-client: Use event-handler mutex consistently
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
[CIR][Docs][www] Generate and publish the CIR dialect reference docs (#232912)
Wire up a consolidated CIR dialect reference page: the existing
-gen-dialect-doc output (operations, types, attributes, enums) plus a
passes section generated from Passes.td (-gen-pass-doc), merged ahead of
the other sections with an explicit index of the page sections.
The landing page grows a "CIR Dialect Reference" section right after
"Using ClangIR", showing an index into the reference page.
Also fix the doc tablegen include roots: the `MLIR_*_INCLUDE_DIR`
variables are still empty when Clang configures (MLIR configures later),
so derive the same roots from LLVM dirs instead; without this the
tablegen cannot find `mlir/*.td`.
[BoundsSafety] Don't orphan a shared counted_by node when one declarator nests it
A late-parsed counted_by-family attribute in declaration-specifier position is
shared by every declarator in the declaration, so they share one incomplete
CountAttributedType. When one declarator nests the node, as `*b` does in
`IP __counted_by(n) a, *b;`, it is rejected and the node is marked rejected.
The completion pass then skipped the node for every declarator, so `a` kept a
CountAttributedType without a count and crashed on use in
FieldDecl::findCountedByField.
Make the rejection apply to the declarator only. The parser checks and clears
the mark after each declarator, and doesn't pair a rejected declarator's field
with the attribute. The completion pass skips an attribute with no fields left,
still without parsing its argument.
Assisted-by: Opus 5.5
[BoundsSafety][test] Add late-parsed counted_by type-attribute coverage
New tests exercising the late-parse fill-in mechanism:
- Sema/attr-counted-by-weird-type-positions{,-late-parsed}.c: counted_by
in assorted type positions, nested pointers, and rejection cases.
- Sema/attr-bounds-safety-function-ptr-param.c: attributes on
function-pointer-typed members.
- Modules/ and PCH/ bounds-safety-attributed-type-late-parsed: the
resolved type round-trips through serialization.
- Sema/attr-counted-by-late-parsed-regressions.c: guards against the
double-free on a nested-record decl-spec attribute and the null-count
escape on a free-function parameter.
[BoundsSafety] Create incomplete counted_by types and wire up the refill
Activate late parsing for the counted_by family (counted_by / sized_by and
their _or_null variants) in type-attribute position, under
-fexperimental-late-parse-attributes, on top of the type-attribute handling,
the validation helper and the refill machinery added in the previous commits.
When such an attribute is seen during type construction and its argument
can't be resolved yet, build the CountAttributedType immediately with
getIncompleteCountAttributedType and record it against the enclosing record;
its count expression is filled in at the closing brace via the refill logic.
Because enclosing types refer to the node by pointer, completing it in place
leaves the type chain untouched.
[BoundsSafety] Handle the counted_by family as a type attribute
counted_by / sized_by (and their _or_null variants) were handled as a
declaration-position attribute through handleCountedByAttrField.
Build the type during type construction instead and properly handle as a
type-position attribute. Building the node in type position also allows
the new way of late-parsing for type attributes: creates a type node
in place and fills it in once late parsing is done, which will be
enabled in the follow-up commits.
Assisted-by: Opus 4.8
[BoundsSafety][NFC] Add late-parsed type attribute lists to declarators
This is groundwork for late-parsing type attributes in every type
position where an ordinary type attribute can appear. Ordinary type
attributes are kept on the DeclSpec, on each DeclaratorChunk and on the
Declarator. Give late-parsed type attributes the same three homes, with
nothing producing or consuming them yet:
- Move CachedTokens and LateParsedAttrList earlier in DeclSpec.h so
that DeclSpec, Declarator and DeclaratorChunk can hold one. Add
LateParsedAttrList::forTypeAttrs() to create those lists.
- Give DeclSpec, Declarator and DeclaratorChunk a LateParsedAttrList,
and let Declarator::AddTypeInfo carry one onto the chunk it appends.
- Give ParseSpecifierQualifierList and ParseTypeQualifierListOpt an
optional LateParsedAttrList parameter. The former passes it to
ParseDeclarationSpecifiers, the latter to ParseGNUAttributes.
No functional change: no caller passes a list yet, so the lists stay
empty. The next commit populates them.
[BoundsSafety][NFC] Build an incomplete CountAttributedType for a late-parsed attribute
Add Sema::ProcessLateParsedTypeAttr. It validates a late-parsed
counted_by-family attribute in type position and wraps the type in a
CountAttributedType whose count is filled in once the enclosing record
is complete.
LateParsedTypeAttribute is owned by the Parser, which Sema cannot depend
on. Sema therefore reads the attribute's kind, location and type slot
through a callback.
No functional change: nothing creates late-parsed type attributes yet,
so ProcessLateParsedTypeAttr is never invoked. The next commit wires it
up.
Assisted-by: Opus 5.5
[NVPTX] Forward-fix tests for SelectionDAG argument lowering change (#232989)
Fix the NVPTX FileCheck failures after #228285 and #230234 landed with
expectations predating #232309's change to argument lowering at `-O0`.
Refresh `mulwide.ll` for folded parameter loads and extensions, and
update `mul-with-overflow.ll` for the parameter-load order. Test IR, RUN
lines, and effective `-O3` checks are unchanged.
Validation:
- Reproduced both failures on main (`83ee07799c34`).
- Both affected tests pass after the updates.
- Full NVPTX CodeGen lit suite: **656/656 passed**.
Assisted-by: Codex
[clang][OpenMP] Match device and target_device ISA names separately
A context selector can name ISAs in both device={isa(...)} and
target_device={isa(...)}. These are separate selectors, but their ISA
names were checked together, so an ISA that the target does not support
made both selectors fail. The default match_all needs both selectors
anyway, but the match_any and match_none extensions selected the wrong
variant. For example, on x86-64:
#pragma omp declare variant(variant) \
match(device = {isa(sse2)}, target_device = {isa(bogus_isa)}, \
implementation = {extension(match_any)})
did not select variant, although device={isa(sse2)} matches. Likewise,
match_none accepted a variant whose target_device ISA matched.
This patch records which selector each ISA name belongs to and check
each selector against its own names only. Because begin declare variant
only looks at the device and implementation sets, a target_device ISA
[5 lines not shown]
[SLP] Handle REVEC when costing expanded compress mask
With REVEC the scalars are vectors. The masked-load-compress shuffle that is
emitted uses the compress mask expanded to the elements of those vectors
(transformScalarShuffleIndiciesToVector), but the cost was computed with the
unexpanded per-vector mask, so a shuffle such as <24 x i8> -> <16 x i8> was
costed as a <2 x i8> shuffle. This made the compress sequence looked cheaper
than it is.
Assisted-By: Claude Sonnet 5.5
[AMDGPU] Stop merging loads and stores in clauses on gfx1250 (#231269)
In CDNA5 the spec states "Once the clause type is determined, any
instruction encountered within the clause that is not of the same type
(and not an internal instruction described below) is illegal and may
lead to undefined behaviour". For GFX10, VMEM/FLAT loads and stores are
mapped to one shared type. However, for CDNA5 these become two
conflicting instruction types and therefore this is undefined behavior.
[mlir] Check greedy rewrite change flag against fingerprints
Compare the driver’s local changed result against whether the enclosing operation fingerprint changed. Keep the result separate from the optional output parameter so the check validates this invocation even when the caller reuses the output variable.
