Merge tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events updates from Ingo Molnar:
- Support SIMD/eGPRs/SSP register sampling in perf
(Dapeng Mi, Kan Liang)
- Turn amd_uncore_ctx events into a flexible array (Rosen Penev)
- Finish the work related to fixing the guest PEBS path to not
set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
are upstream already (Sean Christopherson)
- Drop redundant counter slot searches in the AMD uncore
driver (Usama Arif)
- Don't WARN when the ext_regs_buf allocation fails (vineash)
- Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)
[23 lines not shown]
Merge tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull objtool updates from Ingo Molnar:
- Add unit test suite for objtool klp functionality and
known failure modes (by Song Liu and Puranjay Mohan,
with fixes by Joe Lawrence)
* tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits)
objtool/klp: Add test for ThinLTO symbols sharing a demangled name
objtool/klp: Add test for Clang switch jump tables
objtool/klp: Add test for UBSAN metadata in an unchanged function
objtool/klp: Add test for absolute and __ADDRESSABLE symbols
objtool/klp: Add test for a patch which strips a data annotation
objtool/klp: Add test for the alignment of cloned data sections
objtool/klp: Add test for alternative replacement code in checksums
objtool/klp: Add test for instruction operand checksums
objtool/klp: Add test for a static call introduced by the patch
objtool/klp: Add test for tracepoint and pr_debug static branch keys
[11 lines not shown]
[Clang][CodeGen] Use Thunk.ThisType pointee's alignment for 'this' in vtable thunks (#233555)
In a vtable thunk, the `this` parameter points to the base sub-object,
not the derived class object. Without setting it explicitly, we fall
back to use derived class alignment in
`CodeGenFunction::LoadCXXThisAddress` for thunk function, which is
incorrect.
Assisted-by: Gemini
emulators/wine-proton: Fixup missing winepulse.drv in pkg-plist
This was making pulseaudio driver not operational.
PR: 299632
Sponsored by: UNIS Labs (vvd, commit patch)
[BoundsSafety] Address review feedback on late-parsed counted_by types
Fixes for late-parsed counted_by-family type attributes:
- A block-pointer member hands its late attributes to the block-pointer chunk
instead of asserting, so Sema rejects them like a non-pointer type.
- Late-parse type attributes only in member declarators. Function-pointer
parameters, type names in `sizeof`, and other abstract declarators nested in a
member are parsed eagerly. They used to be resolved in struct scope, and a
paren that turned out to be a parameter list asserted.
- An unnamed struct hands its attributes to the enclosing record only when it's
declared directly in a record, not when it's in a statement expression.
- In declaration-specifier position, only type attributes are late-parsed.
Declaration attributes such as guarded_by are parsed eagerly again, so they
apply to every declarator.
- Reject an attribute on a function return type in the late path too.
- Complete a node whose argument fails to parse with a RecoveryExpr and mark the
fields invalid, rather than leave a CountAttributedType without a count.
- Report a rejected declaration-specifier attribute once rather than once per
[7 lines not shown]
[lldb] Fix compile Python f-strings to improved `@fmt` (#232997)
Updates the `@fmt` selector, by adding support for Python f-strings to
the Python to bytecode compiler, and updating the evaluation of `@fmt`
by improved interfacing with `llvm::formatv`.
Changes to `@fmt`:
* Consume the arguments, leaving only the resulting string on the stack.
Previously, the arguments were left on the stack, unlike what the docs
describe and what the interpreter does.
* In version 2 formatters, replacements are automatically indexed.
Explicit indexes,such as `{0}`, are an error. This makes the stack
effect of `@fmt` clear from the format string: the number of arguments
is the number of replacements, and each argument is used once, in stack
order. Arguments can be reordered or reused with the stack operations.
* In version 2 formatters, layouts and options (`{,8}`, `{:x}`) are
accepted, but are currently ignored. They are treated as best effort
hints, so that support for them can be added later without changing the
[21 lines not shown]
feat(gisel): Mirror trunc/xor/select demanded bits
Extend scalar demanded-bits simplification to G_TRUNC, G_XOR, and
G_SELECT, following SelectionDAG traversal, known-bit propagation,
shared-use handling, and final folds. Honor GISel legality and target
profitability when rewriting or narrowing operations.
Share AArch64's logical-immediate search through a narrow XOR hook and
adapt XOR/shift profitability queries for both selectors. Preserve
SelectionDAG's constant-shrinking interface and node construction.
Share shift-amount validation in CodeGenCommonISel using templated
callbacks for selector-specific lane access and KnownBits queries.
Preserve recursive constant bypasses and use-specific rewrites of shared
producers. Recognize constants at the analysis depth limit, matching
SelectionDAG, and retain KnownBits-based bypasses as a fallback.
Cover AArch64 and AMDGPU with focused MIR and codegen tests, including
shared mask chains, SELECT arms, and depth-limited XOR bypasses.
refactor(codegen): Move shift helpers out of line
Define the shared shift helpers in CodeGenCommonISel.cpp under llvm::detail. Use function_ref callbacks to preserve lazy KnownBits computation, and retain LLVM_ABI for callers in other CodeGen component libraries.
Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
[AArch64] Test the i32 preserve_none argument registers on Windows
CC_AArch64_Preserve_None excludes X15 from the argument registers on
Windows, where it is used for stack allocation, but only the i64 case was
covered by preserve_nonecc_call.ll. Add the i32 counterpart: the 24th i32
argument is passed in w15 on AAPCS and Darwin targets and on the stack on
Windows.
Assisted-by: Claude
[BoundsSafety] Don't orphan a shared counted_by node when one declarator nests it
A late-parsed counted_by-family attribute in declaration-specifier position is
shared by every declarator in the declaration, so they share one incomplete
CountAttributedType. When one declarator nests the node, as `*b` does in
`IP __counted_by(n) a, *b;`, it is rejected and the node is marked rejected.
The completion pass then skipped the node for every declarator, so `a` kept a
CountAttributedType without a count and crashed on use in
FieldDecl::findCountedByField.
Make the rejection apply to the declarator only. The parser checks and clears
the mark after each declarator, and doesn't pair a rejected declarator's field
with the attribute. The completion pass skips an attribute with no fields left,
still without parsing its argument.
Assisted-by: Opus 5.5
[BoundsSafety][test] Add late-parsed counted_by type-attribute coverage
New tests exercising the late-parse fill-in mechanism:
- Sema/attr-counted-by-weird-type-positions{,-late-parsed}.c: counted_by
in assorted type positions, nested pointers, and rejection cases.
- Sema/attr-bounds-safety-function-ptr-param.c: attributes on
function-pointer-typed members.
- Modules/ and PCH/ bounds-safety-attributed-type-late-parsed: the
resolved type round-trips through serialization.
- Sema/attr-counted-by-late-parsed-regressions.c: guards against the
double-free on a nested-record decl-spec attribute and the null-count
escape on a free-function parameter.
[BoundsSafety] Create incomplete counted_by types and wire up the refill
Activate late parsing for the counted_by family (counted_by / sized_by and
their _or_null variants) in type-attribute position, under
-fexperimental-late-parse-attributes, on top of the type-attribute handling,
the validation helper and the refill machinery added in the previous commits.
When such an attribute is seen during type construction and its argument
can't be resolved yet, build the CountAttributedType immediately with
getIncompleteCountAttributedType and record it against the enclosing record;
its count expression is filled in at the closing brace via the refill logic.
Because enclosing types refer to the node by pointer, completing it in place
leaves the type chain untouched.
[BoundsSafety] Reject a second bounds attribute on the same pointer
A pointer with two counted_by-family attributes, as in
`int *__counted_by(n) __sized_by(m) p;`, got one CountAttributedType stacked on
another. Reject the second attribute with
err_counted_by_on_bounds_attributed_type, which names both attributes.
The check is in ValidateBoundsAttrTypeForTypePosition, so it applies however
the attributes are written: both on the pointer, in the declaration specifier,
or one there and one after the declarator. It's skipped under the
-fbounds-safety attribute model, which checks conflicting attributes itself in
checkBoundsAttrTypeConflictsAndMisc.
Assisted-by: Opus 5.5
[BoundsSafety] Reject counted_by on function return types
A counted_by-family attribute on a function's return type, including the
return type of the function a function-pointer or block-pointer member points
to, was reported as a nested pointer. getPointerNestLevel counted every
pointer, array and function chunk between the attribute and the name, so the
function chunk counted as a level of nesting.
Return types aren't supported yet. Reject them with a dedicated diagnostic,
err_counted_by_on_return_type, and measure nesting relative to the type the
attribute belongs to:
- isOnFunctionReturnType is true if any function chunk wraps the attribute.
- getPointerNestLevel counts pointer and array chunks only up to the nearest
function chunk, so in `int *__counted_by(n) *(*fp)(void)` it's 1, relative
to the return type.
ValidateBoundsAttrTypeForTypePosition takes the return-type position next to
the nesting level, and checks both in ValidateBoundsAttrPosition after the type
[3 lines not shown]
[flang][acc] Prefer the reduction mapping when remapping region symbols (#233938)
When a variable appears on several data clauses of one compute
construct, `AccDataMap::remapDataOperandSymbols` bound the region's
symbol to the first data operation result, on the assumption that every
result for a symbol addresses the same memory.
For a reduction the results are not interchangeable. The reduction
clause carries bounds for the section while the data clause maps the
whole variable, so for
```fortran
!$acc parallel loop copy(rarr) reduction(+:rarr(3:10))
```
The variable has two mappings and only the reduction one describes the
accumulator. Binding the region to the whole-array `copy` meant accesses
inside it, including the `acc.reduction` rooted on that declare, were
expressed against the variable's mapping rather than the accumulator's.
[11 lines not shown]
[clang][Driver] Use the Windows ARM64 defaults for aarch64-unknown-uefi
Match the Windows ARM64 driver defaults for aarch64-unknown-uefi, which
follows the same ABI:
* char is signed, so do not pass -fno-signed-char,
* the frame chain must stay valid even when frame pointers are omitted,
so -fomit-frame-pointer yields -mframe-pointer=reserved rather than
none, as the backend reserves the frame pointer for UEFI as well,
* -msign-return-address selects the B key, the only one the backend
accepts for Windows and UEFI.
Assisted-by: Claude
