Skip to content

Merge tag 'v6.18.44' into qcom-6.18.y - #970

Merged
Salendarsingh Gaud (sgaud-quic) merged 3298 commits into
qualcomm-linux:qcom-6.18.yfrom
nsiddams:6.18.44-lts
Sep 7, 2026
Merged

Salendarsingh Gaud (sgaud-quic) merged 3298 commits into
qualcomm-linux:qcom-6.18.yfrom
nsiddams:6.18.44-lts

Conversation

@nsiddams

@nsiddams nsiddams (nsiddams) commented Aug 18, 2026

Copy link
Copy Markdown

CR:4656222

Gabriele Monaco (glemco) and others added 30 commits August 9, 2026 20:25
[ Upstream commit 1842bf9 ]

Commit 14a8570 ("sched/deadline: Use revised wakeup rule for
dl_server") applies the revised wakeup rule to any server, as a result
servers that are not running (dl_defer_running == 0) and start with a
deadline overflow get enqueued and can boost tasks as if they were
running, invalidating the defer rule and the documented state model.

Apply the revised wakeup rule only for deferrable servers that are
marked as running.

Fixes: 14a8570 ("sched/deadline: Use revised wakeup rule for dl_server")
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Tested-by: Andrea Righi <arighi@nvidia.com>
Link: https://patch.msgid.link/20260522125833.264145-1-gmonaco@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
…orted SoCs

[ Upstream commit 9c19d60 ]

The commit f43579e ("spi: spi-nxp-fspi: limit the clock rate for
different sample clock source selection") introduced a global 166MHz
cap for DTR mode (RXCLKSRC=3), based on the i.MX8MN datasheet timing
specification (Section 3.9.9, page 65).

After reviewing the FlexSPI timing parameters in the datasheets for all
supported SoCs, the following corrections and additions are needed:

1. SDR mode (RXCLKSRC=0) limits vary per SoC:
   - i.MX8MN/MM/MP/95: 66MHz  (IMX8MNCEC §3.9.9, IMX8MMCEC §3.9.10,
                                IMX8MPCEC, IMX95CEC Rev.8 §4.11.7)
   - i.MX8QXP/QM/DXL/ULP: 60MHz (IMX8QXPCEC, IMX8QMCEC, IMX8DXLCEC,
                                   IMX8ULPCEC §7.3.1 ND mode)
   - LX2160A: 100MHz            (LX2160ACEC FlexSPI timing parameters)

2. DTR mode (RXCLKSRC=3) limits vary per SoC:
   - i.MX8MN/MM/MP/ULP: 166MHz
   - i.MX8QXP/QM/DXL: 200MHz   (same FlexSPI IP across this family)
   - i.MX95: 200MHz             (IMX95CEC §4.11.7.3.2.3 Table 106)
   - LX2160A: DTR disabled      (FSPI_QUIRK_DISABLE_DTR)

Update related platform data with correct speed limation according
to datasheet.

Fixes: f43579e ("spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Link: https://patch.msgid.link/20260728-fspi-clock-v2-1-dbe786a4a6eb@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 451c907 ]

A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports
configured wedges the rtnetlink control plane of the whole machine:

  NETDEV WATCHDOG: ens6f1 (qede): transmit queue 2 timed out 10226 ms
  [qede_tx_timeout:586(ens6f1)]TX timeout on queue 2!
  [qede_recovery_handler:2665(ens6f0)]Starting a recovery process

The recovery path deadlocks on the driver's own mutex:

  qede_sp_task
   rtnl_lock()
   mutex_lock(&edev->qede_lock)        <- taken
   qede_recovery_handler
    qede_load
    udp_tunnel_nic_reset_ntf
     __udp_tunnel_nic_device_sync
      info->sync_table == qede_udp_tunnel_sync
       mutex_lock(&edev->qede_lock)    <- same task: deadlock

The mutex is not recursive, so the kworker blocks on itself with
rtnl_lock held, and neither lock is ever released. Every task that
calls rtnl_lock() afterwards (ip, ovs-vswitchd, lldpad, IPv6
addrconf, sshd) blocks forever while the node still answers ping.
In a vmcore from an affected production node rtnl_mutex.owner
decodes to the very kworker blocked at the innermost mutex_lock()
above.

Re-sync the tunnel ports from qede_sp_task() after the internal lock
is dropped, still under rtnl_lock as the udp_tunnel API requires.
This mirrors qede_open(), which calls udp_tunnel_nic_reset_ntf()
under rtnl without the internal lock.

qede_recovery_handler() now returns whether it has successfully
reloaded an open device, and the caller re-syncs the ports only in
that case. This keeps the old gating exactly: a device that was down
or a failed recovery returns false, as those paths never reached the
udp_tunnel_nic_reset_ntf() call before either.

This was the only user of the qede_lock()/qede_unlock() helpers, so
remove them.

Fixes: 8cd160a ("qede: convert to new udp_tunnel_nic infra")
Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Andrew Lunn <andrew+netdev@lunn.ch>
CC: "David S. Miller" <davem@davemloft.net>
CC: Eric Dumazet <edumazet@google.com>
CC: Jakub Kicinski <kuba@kernel.org>
CC: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20260726104311.1782900-1-den@openvz.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1afb8ea ]

HDMI 2.0 section 6.1.3.1 specifies that after enabling
Scrambling_Enable and starting scrambled video transmission, the source
should poll Scrambling_Status until it reads 1 or until a timeout of
200 ms expires.

Add a polling step after enabling the HDMI port to check the scrambling
status when HDMI scrambling is enabled.

On some HDMI 2.0 sinks, omitting this check can result in 4K@60Hz
(594 MHz) failing to come up correctly because the sink has not yet
finished its scrambling setup. In practice, waiting for the scrambling
status here fixes such sinks.

While this synchronous polling is not itself explicitly required for
correct modeset sequencing, HDMI 2.0 section 6.1.3.1 does recommend it
as the way for the source to verify that the TMDS link is functioning
correctly with scrambling enabled.

v3:
 - Add explicit HDMI 2.0 section reference in code comment
 - Clarify commit message around the observed sink fix

v2:
 - Poll TMDS_Scrambler_Status for up to 200 ms instead of using a fixed
   delay

Reported-by: Jerome Tollet <jtollet@cisco.com>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6868
Link: https://lore.kernel.org/dri-devel/20251230091037.5603-1-jerome.tollet@gmail.com/
Signed-off-by: Jerome Tollet <jerome.tollet@gmail.com>
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com>
Link: https://patch.msgid.link/20260520022544.3097252-1-ankit.k.nautiyal@intel.com
(cherry picked from commit b7d51d6)
Fixes: 1595363 ("drm/i915: enable scrambling")
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c5db4de ]

ksmbd_close_fd() marks an open file as FP_CLOSED and drops the file table
reference. If another in-flight request still holds a reference, the final
close is deferred until that request drops its reference.

The function currently returns -EINVAL in that deferred-final-close case
because fp is cleared when the reference count does not reach zero.  That
turns a valid close into STATUS_FILE_CLOSED.

smb2.compound_find.compound_find_close sends QUERY_DIRECTORY and then
closes the same directory handle before receiving the find response.
The query holds a reference while it builds the response, so close must
mark the handle closed and return success even though final teardown is
delayed. Track whether the handle was successfully transitioned to
FP_CLOSED and return success when only the final close is deferred.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: e718819 ("ksmbd: fix use-after-free in __close_file_table_ids()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e718819 ]

A ksmbd_file can remain alive after logical close while another session
holds a temporary reference obtained through ksmbd_lookup_fd_inode().
ksmbd_close_fd() currently marks the file closed and drops the idr-owned
reference, but leaves the pointer published in the closing session's idr
until the final reference is dropped.

If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()
supplies the foreign session's file table to __ksmbd_close_fd(). The object
is then freed without being removed from its owner's idr, and the owner
session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbd_close_fd() still
holds that table's lock, and clear volatile_id before dropping
the idr-owned reference. A later foreign final put then only performs
physical destruction and cannot remove the object from the wrong table.

Fixes: 8510a04 ("ksmbd: increment reference count of parent fp")
Reported-by: Yunseong Kim <yunseong.kim@est.tech>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c679ce3 ]

iomap_split_ioend can split bios that already come from
iomap_ioend_bioset and thus deadlock when the bioset is exhausted.

Add a separate bio_set to avoid this deadlock.

Christian Brauner <brauner@kernel.org> says:
Mark iomap_ioend_split_bioset static as it is only used in ioend.c,
fixing the sparse warning reported by the kernel test robot.

Fixes: 5fcbd55 ("iomap: split bios to zone append limits in the submission handlers")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260629125229.3400726-1-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0762262 ]

mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().

Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.

Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
  traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
  marked as unhashed after removal, making the is_active guard reliable.

Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9d70ef7 ]

Interrupt control structure (union hv_interupt_control) has different
fields when it comes to x86 vs ARM64. Bring in the correct structure
from HyperV header files and adjust the existing interrupt routing
code accordingly.

Signed-off-by: Jinank Jain <jinankjain@microsoft.com>
Signed-off-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Stable-dep-of: 0289a67 ("mshv: Fix level-triggered check on uninitialized data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 0289a67 ]

In mshv_irqfd_assign(), the level-triggered validation for resample
irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before
mshv_irqfd_update() has populated the field. Since the irqfd struct is
zero-allocated, level_triggered is always 0 at that point, causing the
check to always reject resample irqfds with -EINVAL. This makes
level-triggered interrupt resampling — used to avoid interrupt storms
with assigned devices — completely non-functional.

Move the check after the mshv_irqfd_update() call, which resolves the
IRQ routing entry and populates irqfd_lapic_irq with the actual trigger
mode.

Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b098dc8 ]

mshv_partition_ioctl_create_vp() initialises a VP struct (allocations,
mutex_init, init_waitqueue_head, page mappings) and then publishes the
pointer into partition->pt_vp_array.  Several ISR paths read this array
locklessly: the intercept ISR, the two scheduler ISRs, and
mshv_try_assert_irq_fast() on the irqfd fast path.

Of these, only mshv_try_assert_irq_fast() can structurally race the
publish.  It runs from an eventfd waker without holding pt_mutex, and
MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to
refer to an existing VP at registration time.  A user can therefore
register an irqfd targeting a yet-to-be-created VP, then trigger
mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the
same index.  On weakly-ordered architectures the reader can observe a
non-NULL pointer in pt_vp_array before the initialising stores to the
VP struct become visible, leading to use of partially-initialised
fields (e.g. vp_register_page).

The other ISR readers cannot reach this race: the hypervisor will not
generate intercept or scheduler messages for a VP that has never been
told to run, and the user can only call MSHV_RUN_VP on the VP fd
returned by MSHV_CREATE_VP, which by construction is returned after
the publish.  Leave those readers as plain loads.

Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish
the pointer, and pair it with smp_load_acquire() in
mshv_try_assert_irq_fast().  On x86 these compile to plain accesses
under TSO; on ARM64 they emit one-instruction acquire/release barriers,
acceptable on this fast path.

The destroy-side path (destroy_partition() clearing pt_vp_array[i] to
NULL after kfree(vp)) has a separate ordering and lifetime concern
that is out of scope here.

Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 339bd11 upstream.

iommufd_vdevice_alloc_ioctl() takes idev->igroup->lock, then validates the
driver's vdevice_size against the core structure size with a WARN_ON_ONCE.
On failure that guard jumps to out_put_idev, below out_unlock_igroup, so it
skips the mutex_unlock(), leaving the igroup lock held and deadlocking the
next vDEVICE operation on that group.

Jump to out_unlock_igroup instead.

Fixes: ed42eee ("iommufd/viommu: Add driver-defined vDEVICE support")
Link: https://patch.msgid.link/r/e903f775d491296a525097e2a90b3eb6a47cf2ef.1783311134.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9be311c upstream.

iommufd_vdevice_alloc_ioctl() adds the vDEVICE to the viommu->vdevs xarray
with xa_cmpxchg() before the driver's vdevice_init() op runs. That op is
where a driver validates the device and may reject it, but the xarray entry
is already live by then: a concurrent IOMMU_HWPT_INVALIDATE can look it up
with iommufd_viommu_find_dev() and run the driver invalidation path against
a device that vdevice_init() would have refused.

Reserve the index with xa_insert(): it stores a zero entry that reads back
as NULL, and returns -EBUSY on a duplicate virt_id. Run vdevice_init() and
store the vDEVICE pointer only once it succeeds. A failed vdevice_init()
releases the reservation, so lookups observe the vDEVICE only after it is
fully initialized and accepted.

Fixes: ed42eee ("iommufd/viommu: Add driver-defined vDEVICE support")
Link: https://patch.msgid.link/r/1e05999347f4bf583edbc6a1312c857d5548708c.1783311134.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…lace

commit ba5c0f2 upstream.

iommufd_hwpt_replace_device() calls:

	iommufd_auto_response_faults(hwpt, old_handle);

passing the *new* hwpt together with the handle of
the device's *old* domain. This should be a parameter mismatch:

1. Semantically, iommufd_auto_response_faults(x, handle) scans
   x->fault's deliver list and response xarray for groups matching
   "handle". A group is queued under the hwpt that was attached at
   fault-delivery time. old_handle is fetched *before* the domain switch,
   so its group lives on old->fault, not on the new hwpt->fault.

2. Historically, the first argument was "old". The routine was
   introduced by commit b7d8833 ("iommufd: Fault-capable hwpt
   attach/detach/replace") as __fault_domain_replace_dev() in
   fault.c, correctly calling iommufd_auto_response_faults(old, curr).
   Commit fb21b15 ("iommufd: Make attach_handle generic than
   fault specific") moved this into iommufd_hwpt_replace_device() in
   device.c and swapped it to "hwpt". This should be a refactor regression,
   not an intentional change.

Fix this by passing "old" instead.

Link: https://patch.msgid.link/r/9D652384339C69D5+20260710122952.885325-1-peiyang_he@smail.nju.edu.cn
Fixes: fb21b15 ("iommufd: Make attach_handle generic than fault specific")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 738e6f3 upstream.

iopf_group_alloc() links each last-page IOPF group into the generic IOPF
pending list before invoking the domain fault handler.
iommufd_fault_iopf_handler() also queued an accepted group in the
IOMMUFD deliver list without removing it from the generic pending list.

When detach or HWPT replacement drops the device's IOPF reference count
to zero, an IOMMU driver may call iopf_queue_remove_device(). That
function responds to and frees groups through the generic pending list
without removing the same groups from IOMMUFD's deliver list or response
xarray. A later read, response, or cleanup can then access the freed
group and cause a UAF.

Fix this by dequeuing an accepted group from the generic pending list
before IOMMUFD queues it for userspace response.
Make iopf_group_response() send a response regardless of pending-list
membership, so the dequeued group can still be completed by IOMMUFD.

Link: https://patch.msgid.link/r/3CFD314D0FE4D7EC+20260720085017.3998878-2-peiyang_he@smail.nju.edu.cn
Closes: https://lore.kernel.org/all/B4F28798E2E784CA+d29f723c-b2b5-4b67-8d1c-4f7b9b0b27cb@smail.nju.edu.cn/
Fixes: 34765cb ("iommufd: Associate fault object with iommufd_hw_pgtable")
Cc: stable@vger.kernel.org
Tested-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 25cb6e9 upstream.

The driver calls ocelot_regmap_from_resource() via <linux/mfd/ocelot.h>,
which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO.
The Kconfig entry does not select REGMAP_MMIO, causing a build failure
when no other driver in the config happens to pull in REGMAP_MMIO:

  include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio'

Found by randconfig testing on arm64; tinyconfig reproducer below.

Fixes: 2afbbab ("pinctrl: microchip-sgpio: update to support regmap")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 015b5bc upstream.

dt_remember_or_free_map() duplicates dev_name for each map entry. If
kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with
kmalloc() and leave dev_name for the core to initialize. The untouched
entries therefore contain uninitialized data which is passed to
kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
while binding the pinctrl-consuming device, under KASAN:

  BUG: KASAN: double-free in dt_free_map+0x34/0xa4
  Free of addr c425a900 by task init/1
   kfree from dt_free_map+0x34/0xa4
   dt_free_map from dt_remember_or_free_map+0x184/0x198
   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_name fields to NULL before duplicating the device
name, making the full-map cleanup safe after a partial failure.

Fixes: be4c60b ("pinctrl: devicetree: Avoid taking direct reference to device name string")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c9b47e6 upstream.

fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB.  On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.

Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.

Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.

Fixes: 622cead ("erofs: lzma compression support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dad6e10 upstream.

drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with
.is_generic = true, but that field is only present when
CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h).
The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF,
so any config that enables CONFIG_PINCTRL_BM1880=y without
CONFIG_GENERIC_PINCONF=y fails to compile:

  drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic'

Found by randconfig testing on arm64; tinyconfig reproducer below.
Add the missing select to fix the build.

Fixes: 49bd61e ("pinctrl: Add pinconf support for BM1880 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c1f3e77 upstream.

clang recently added support for -Wstringop-overread [1], which is on by
default like -Wfortify-source. This breaks the usage of -Werror in the
fortify tests, resulting in the following false positive warnings in the
kernel build:

  warning: unsafe memcmp() usage lacked '__read_overflow2' warning in lib/test_fortify/read_overflow2-memcmp.c
  warning: unsafe memcmp() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memcmp.c
  warning: unsafe memchr() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memchr.c

Examining the fortify test logs shows a warning like the following in
each of the failed logs:

  In file included from lib/test_fortify/read_overflow2-memcmp.c:5:
  lib/test_fortify/test_fortify.h:34:2: error: 'memcmp' reading 17 bytes from a region of size 16 [-Werror,-Wstringop-overread]
     34 |         TEST;
        |         ^
  lib/test_fortify/read_overflow2-memcmp.c:3:2: note: expanded from macro 'TEST'
      3 |         memcmp(large, small, sizeof(small) + 1)
        |         ^
  1 error generated.

Disable -Wstringop-overread for the fortify tests, as it defeats the
purpose of testing the Linux specific implementation of fortify, like
-Wfortify-source.

Cc: stable@vger.kernel.org
Closes: ClangBuiltLinux/linux#2168
Link: llvm/llvm-project@86f2e71 [1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260623-fix-test_fortify-for-clang-stringop-overread-v1-1-15ee8342a953@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 63867c8 upstream.

pte_pfn() and pte_dirty() have undefined behaviour when called on a
non-present PTE. In migrate_vma_collect_pmd(), these functions may be
invoked on non-present entries (e.g., device-private entries), leading
to potential crashes from pte_pfn() or incorrect dirty folio accounting
from pte_dirty(). Fix both by guarding with pte_present() checks.

Link: https://lore.kernel.org/20260708003955.4024340-1-wangkefeng.wang@huawei.com
Link: https://lore.kernel.org/20260706111958.3649651-1-wangkefeng.wang@huawei.com
Fixes: fd35ca3 ("mm/migrate_device.c: copy pte dirty bit to page")
Fixes: 6c28760 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive")
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Gregory Price <gourry@gourry.net>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7441d63 upstream.

snapshot_page() currently reads __page_2 after checking nr_pages > 1, but
it should only do so when nr_pages > 2.

If an order-1 folio is allocated at the end of a vmemmap section,
__page_2 will not exist and reading it will cause a fault.

During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed
on the page isolation path while reading an order-1 folio's __page_2 from
an adjacent absent section (unmapped vmemmap).

Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap
hole).

Link: https://lore.kernel.org/20260708201954.686111-1-aboorvad@linux.ibm.com
Fixes: 31a31da ("mm: move _pincount in folio to page[2] on 32bit")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Luiz Capitulino <luizcap@redhat.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org> # v6.15+
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e3a0127 upstream.

fclog.c does not compile because it is missing fcntl.h, needed for
O_RDONLY etc.

There are also some redundant includes that are also in
kselftest_harness.h.

Link: https://lore.kernel.org/20260710171741.837308-1-jkoolstra@xs4all.nl
Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 40de816 upstream.

PAGEMAP_SCAN reports an unpopulated PTE in a uffd-wp VMA as written, but a
range with no page table at all -- a PMD hole -- is skipped:
pagemap_scan_pte_hole() tests p->cur_vma_category, which never carries
PAGE_IS_WRITTEN, so the hole is neither reported nor (under
PM_SCAN_WP_MATCHING) armed.

In a uffd-wp VMA, WP_UNPOPULATED installs uffd-wp markers when protecting
a range, allocating page tables as needed, so an unpopulated slot is
treated as written -- see the pte_none() handling in
pagemap_page_category().  A missing marker therefore means the range was
zapped, e.g.  via MADV_DONTNEED.  This applies to anon and shmem VMAs.

An anonymous THP is write-protected in place as a huge PMD, so a full-PMD
MADV_DONTNEED clears it to pmd_none -- a hole with no page table -- and
pagemap_scan_pte_hole() misses it.  For a MAP_PRIVATE|MAP_ANON mapping
MADV_DONTNEED has fill-with-zeros semantics, so a write-tracking
checkpoint/migration tool (e.g.  CRIU) treats the range as unchanged and
keeps its previous contents; after restore or live migration the process
reads stale data instead of zeroes -- data corruption.

Report a hole in a non-hugetlb uffd-wp VMA as written, matching the
pte_none handling in pagemap_page_category(); the existing
PM_SCAN_WP_MATCHING path then arms it via uffd_wp_range().

hugetlb is excluded: pagemap_hugetlb_category() reports an empty hugetlb
entry (huge_pte_none) as not-written, unlike pagemap_page_category(),
which reports pte_none as written.  pagemap_scan_pte_hole() fires for a
hugetlb slot only when it has no page table; keeping that not-written
matches how an allocated-but-empty hugetlb entry reads, so the hole and
the empty-entry cases agree within the VMA.

Link: https://lore.kernel.org/20260715144234.442721-2-kirill@shutemov.name
Fixes: 2bad466 ("mm/uffd: UFFD_FEATURE_WP_UNPOPULATED")
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260707151349.92143-1-kirill@shutemov.name
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zenghui Yu <zenghui.yu@linux.dev>
Assisted-by: Claude:claude-fable-5
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 89b1b79 upstream.

In pcpu_create_chunk(), nr_pages is the total contiguous backing
allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
Since bit N in chunk->populated means page offset N inside every unit is
backed.  When nr_units > 1, the function writes beyond chunk->populated.
Fix it by using chunk->nr_pages.

It also fixes the global pcpu_nr_empty_pop_pages accounting, since
pcpu_balance_free() only iterates up to chunk->nr_pages.

Commit a63d4ac ("percpu: make percpu-km set chunk->populated bitmap
properly") introduced the bitmap overflow issue.  Later, commit
b539b87 ("percpu: implmeent pcpu_nr_empty_pop_pages and
chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
accounting issue.

Link: https://lore.kernel.org/20260709-fix-pcpu_create_chunk-in-percpu-km-v1-1-1f64745a84cc@nvidia.com
Fixes: a63d4ac ("percpu: make percpu-km set chunk->populated bitmap properly")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1
Assisted-by: Codex:GPT-5
Signed-off-by: Zi Yan <ziy@nvidia.com>
Acked-by: Dennis Zhou <dennis@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dd9623f upstream.

allocate_file_region_entries() tops up resv->region_cache with freshly
allocated file_region descriptors.  The allocation uses GFP_KERNEL, so
resv->lock is dropped around it: the new entries are gathered on a
stack-local list head, allocated_regions, and spliced into
resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not
re-initialize the source head, so allocated_regions is left pointing at an
entry that now lives on resv->region_cache.  The top-up runs in a while
loop that re-checks the cache deficit after re-acquiring the lock.  For a
shared mapping the resv_map is shared by every mapper of the hugetlbfs
inode, so a concurrent region_chg()/region_add()/region_del() on the same
resv_map can consume cache entries during the unlocked window and force a
second iteration.  That iteration calls list_add() on the stale head and
corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
trips:

  list_add corruption. next->prev should be prev (ffffc900011ff7f8),
  but was ffff88814c281460. (next=ffff88814c545640).
  kernel BUG at lib/list_debug.c:31!
   allocate_file_region_entries+0x191/0x420
   region_chg+0x267/0x300
   hugetlb_reserve_pages+0x387/0xc80
   hugetlbfs_file_mmap+0x2ce/0x3f0
   mmap_region+0x1348/0x1a80
   do_mmap+0x85e/0xb90
   vm_mmap_pgoff+0x18c/0x330
   ksys_mmap_pgoff+0x2a1/0x3e0
   do_syscall_64+0xd7/0x420

Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
address into resv->region_cache, leading to later use-after-free.

This was observed as a real host panic on a dense KVM host where a QEMU
guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one
shared resv_map.

Use list_splice_init() so the source head is re-initialized empty after
each splice, making the retry loop safe.

Link: https://lore.kernel.org/20260713171456.300518-2-caixiangfeng@bytedance.com
Fixes: d3ec7b6 ("mm/hugetlb: use list_splice to merge two list at once")
Signed-off-by: Xiangfeng Cai <caixiangfeng@bytedance.com>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ea3034b upstream.

A per-node vmstat counter is pgdat->vm_stat[] plus per-cpu deltas.  A
balanced counter can sit split as global=+N / per-cpu=-N.

The folds reconciling the split only walk online nodes, so when
try_offline_node() marks a node offline the per-cpu deltas are stranded.

A subsequent online resets the per-cpu area but not pgdat->vm_stat[],
orphaning the +N permanently.  All NR_VM_NODE_STAT_ITEMS are affected.

The existing code zeroes the per-cpu counters and causes a permanent skew.
Fold the stranded deltas instead, before the node rejoins the online set.
The node is not online yet and the hotplug lock is held, so the remote
access to per-cpu values is safe.

Discovered when node compaction hung for a nearly empty node, as the math
to determine throttling broke.  Reproduced by repeated memory
hotplug/unplug cycles on a node under pressure: NR_ISOLATED_ANON ratchets
up and never returns to zero.

Link: https://lore.kernel.org/20260627202243.758289-1-gourry@gourry.net
Fixes: 75ef718 ("mm, vmstat: add infrastructure for per-node vmstats")
Signed-off-by: Gregory Price <gourry@gourry.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 00a8ce2 upstream.

traceprobe_expand_meta_args() parses $argN with simple_strtoul() and
calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is
-1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in
sprint_nth_btf_arg() does not catch the negative index, and
ctx->params[-1].name_off is read out of bounds.

The normal per-argument path (parse_probe_vars()) already rejects
$arg0 via its argument-number check, but meta-argument expansion runs
before per-argument parsing and substitutes the value first, bypassing
that check.

Reject $arg0 explicitly during expansion.

Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/

Fixes: 18b1e87 ("tracing/probes: Add $arg* meta argument for all function args")
Cc: stable@vger.kernel.org
Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aca0cd1 upstream.

enable_trace_fprobe() sets the file link or the TP_FLAG_PROFILE flag and
then registers each trace_fprobe in the probe list. If
__register_trace_fprobe() fails partway through, the function returns
immediately without unregistering the trace_fprobes it already registered
or undoing the file link / flag it set, leaving the event half-enabled and
leaking the registered fprobe(s).

enable_trace_kprobe() already handles this with a rollback path. Do the
same for fprobe: on failure, unregister all probes and clear the file link
or profile flag.

Link: https://lore.kernel.org/all/20260724064208.480030-1-raushan.jhon@gmail.com/

Fixes: 334e551 ("tracing/probes: Add fprobe events for tracing function entry and exit.")
Cc: stable@vger.kernel.org
Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0e65cd9 upstream.

VMCLEAR/VMREAD/VMWRITE/VMPTRLD access the internal VMCS cache, which
is not visible to the compiler; without a memory clobber, the compiler
can reorder them in troublesome ways because "asm volatile" and "asm goto"
only protect against removal of the asm.  For example, placing a VMWRITE
before the corresponding VMCS pointer is loaded can lead to corruption.
While none of this has been observed, it is better to prevent than cure.

Likewise, INVEPT and INVVPID access the TLB and, even though in their
case the effect is only visible to the next VMLAUNCH/VMRESUME, it is
technically correct to add the clobber there too.  So avoid any urge to
special case them, and simply hardcode "memory" into the clobber list
of vmx_asm1() and vmx_asm2().  __vmcs_readl() open-codes its own asm,
so add the clobber there as well.

Link: https://lore.kernel.org/kvm/CABgObfbL3t21yVeSwiLSjjOUER+rTYDPHYAH9YU4TWGRjx6XHg@mail.gmail.com/
Cc: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@qcomlnxci

Copy link
Copy Markdown

Test Matrix

Test Case hamoa-iot-evk-multimedia lemans-evk-multimedia monaco-evk-multimedia purwa-iot-evk-multimedia qcs615-ride-multimedia qcs6490-rb3gen2-multimedia qcs8300-ride-multimedia qcs9100-ride-r3-multimedia shikra-iqs-evk-multimedia
Audio_Card_Registration ✅ Pass ✅ Pass ✅ Pass ⚠️ skip ◻️ ✅ Pass ⚠️ skip ◻️ ⚠️ skip
BT_FW_KMD_Service ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_ON_OFF ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_SCAN ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
CPUFreq_Validation ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
CPU_affinity ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
DSP_AudioPD ✅ Pass ✅ Pass ✅ Pass ⚠️ skip ◻️ ✅ Pass ✅ Pass ◻️ ⚠️ skip
Ethernet_Basic_Validation ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip ◻️ ⚠️ skip ❌ Fail ◻️ ⚠️ skip
Freq_Scaling ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
GIC ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ❌ Fail
IPA ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
Interrupts ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
KVM_Driver ❌ Fail ✅ Pass ✅ Pass ❌ Fail ◻️ ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_EL2_DTB ❌ Fail ✅ Pass ✅ Pass ❌ Fail ◻️ ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_Infra ❌ Fail ✅ Pass ✅ Pass ❌ Fail ◻️ ❌ Fail ❌ Fail ◻️ ❌ Fail
OpenCV ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
PCIe ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
Probe_Failure_Check ❌ Fail ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ❌ Fail ◻️ ❌ Fail
RMNET ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
UFS_Validation ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ⚠️ skip
USBHost ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ◻️ ❌ Fail
WiFi_Firmware_Driver ✅ Pass ✅ Pass ❌ Fail ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
WiFi_OnOff ✅ Pass ✅ Pass ❌ Fail ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ⚠️ skip
adsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ◻️ ⚠️ skip
cdsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
gpdsp_remoteproc ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip ◻️ ⚠️ skip ✅ Pass ◻️ ⚠️ skip
hotplug ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
irq ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
kaslr ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
pinctrl ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
qcom_hwrng ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ◻️
rngtest ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
shmbridge ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
smmu ❌ Fail ❌ Fail ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
watchdog ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass
wpss_remoteproc ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ◻️ ✅ Pass

* refs/heads/1efe5d0:
  Linux 6.18.44
  drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
  drm/fb-helper: Fix a locking bug in an error path
  usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
  can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
  can: use skb hash instead of private variable in headroom
  drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
  drm/xe: Add page reclamation info to device info
  drm/xe: Stub out new pagefault layer
  drm/xe: Use SVM range helpers in PT layer
  drm/i915/vrr: require valid min/max vfreq for VRR
  drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
  drm/xe: Wait on external BO kernel fences in exec IOCTL
  drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
  drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
  drm/xe/vm: Prevent binding of purged buffer objects
  drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
  drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
  drm/xe/pat: Add helper to query compression enable status
  drm/amd/display: Exit idle optimizations before programming
  drm/amd/display: check GRPH_FLIP status before sending event
  drm/xe/guc: Fix buffer overflow in steered register list allocation
  drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
  drm/amdgpu: Fix context pstate override handling
  drm/tegra: fbdev: Remove offset into framebuffer memory
  drm/fb-helper: Allocate and release fb_info in single place
  userfaultfd: prevent registration of special VMAs
  wifi: brcmfmac: drain bus_reset work on device removal
  media: uapi: rkisp: Correct name version enum
  media: qcom: camss: Fix RDI streaming for CSID 340
  media: qcom: camss: csid-340: Fix unused variables
  media: chips-media: wave5: Support CBP profile
  usb: typec: ucsi: Fix race condition and ordering in port unregistration
  usb: typec: ucsi: split connector lock classes
  net/handshake: Drain pending requests at net namespace exit
  net/handshake: Close the submit-side sock_hold race
  net/handshake: hand off the pinned file reference to accept_doit
  net/handshake: Take a long-lived file reference at submit
  net/handshake: Fix null-ptr-deref in handshake_complete()
  net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
  file: ensure cleanup
  file: add FD_{ADD,PREPARE}()
  mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
  mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
  drm/xe/rtp: Ensure locking/ref counting for OA whitelists
  drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
  drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
  drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
  drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
  drm/xe/rtp: Generalize whitelist_apply_to_hwe
  drm/xe/rtp: Keep track of non-OA nonpriv slots
  drm/xe/rtp: Maintain OA whitelists separately
  drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
  drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
  HID: logitech-dj: Fix maxfield check in DJ short report validation
  spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
  drm/vmwgfx: validate external BO copy bounds for both stride paths
  drm/vmwgfx: use check_add_overflow for shader size+offset bound
  drm/vmwgfx: enforce cursor size limits for MOB cursors
  drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
  drm/vmwgfx: bound DMA command body size against suffix pointer
  drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
  drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
  drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
  drm/vmwgfx: clamp dirty-page range with min, not max
  drm/vmwgfx: reject DX_BIND_QUERY without a DX context
  drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
  drm/amdkfd: hold event_mutex while checkpointing CRIU events
  drm/amdkfd: Handle invalid event type in CRIU event restore
  drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
  drm/amdkfd: fix QID bit leak in pqm_create_queue()
  drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
  drm/amd/display: use proper context for logging
  drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
  drm/amd/pm: fix torn gpu metrics reads
  drm/amdgpu: cap GTT size to physical RAM on APUs
  drm/amdgpu: restore UMD profile pstate after runtime resume
  drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
  drm/mediatek: ovl_adaptor: balance component registrations
  drm/panthor: validate firmware interface structure sizes
  drm/panthor: reject firmware sections with oversized data
  drm/bridge: display-connector: Fix I2C adapter resource leak
  drm/vc4: Zero the tile state data array before each BIN job
  drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
  drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
  can: ctucanfd: mark error-active controller status valid
  can: ctucanfd: handle bus error interrupts
  can: ctucanfd: unmap BAR0 using base address
  can: ctucanfd: use self-test mode for PRESUME_ACK
  can: ctucanfd: add missing MODULE_DEVICE_TABLE()
  can: peak_usb: validate uCAN receive record lengths
  can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
  can: peak_usb: add bounds check for USB channel index
  can: softing: fw_parse(): validate firmware record spans
  can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
  can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
  can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
  can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
  can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
  can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
  can: ems_usb: validate CPC message lengths
  can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
  i2c: imx: Cancel hrtimer before clearing slave pointer
  i2c: imx: Fix slave registration race and error handling
  i2c: imx: mark I2C adapter when hardware is powered down
  i2c: iproc: reset bus after timeout if START_BUSY is stuck
  i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
  i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
  i2c: spacemit: request IRQ after controller initialization
  ice: fix memory leak in ice_lbtest_prepare_rings()
  ice: fix VF interrupts cleanup
  ice: wait for reset completion in ice_resume()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: openvswitch: fix potential UAF on meter attach failure
  phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
  phy: zynqmp: use read-modify-write for SERDES scrambler bypass
  phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
  s390/zcrypt: Validate length for CCA ECC private key requests
  s390/zcrypt: Validate length for CCA AES cipher key requests
  s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
  s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
  s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
  s390/dasd: Fix undersized format-check buffer
  s390/dasd: Fix potential NULL pointer dereference
  s390/qeth: Check CAP_NET_ADMIN for private ioctls
  s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
  power: supply: max17040: handle missing status supplier
  power: supply: bq25890: fix the -10 C NTC lookup entry
  cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
  cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
  cifs: add fscache_resize_cookie() to cifs_setsize()
  gpio: pch: use raw_spinlock_t for the register lock
  gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
  i2c: amd-mp2: Unregister callback on adapter add failure
  hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
  hwmon: (npcm750-pwm-fan): stop fan timer on device detach
  sctp: prevent peer transport count overflow
  sctp: reject stale cookies with mismatched verification tags
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  selftests/clone3: fix wild pointer access of getline due to missing init
  selftests/mm: fix potential wild pointer access of getline due to missing init
  spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
  spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
  tracing/filters: Fix false positive match in regex_match_full()
  tracing: Check return value of __register_event() in trace_module_add_events()
  ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
  vxlan: use pskb_network_may_pull() in route_shortcircuit()
  vxlan: use pskb_network_may_pull() for transmit path header pulls
  vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  vxlan: unclone skb head before modifying eth header in route_shortcircuit()
  vxlan: re-fetch eth header after route_shortcircuit()
  veth: convert frag_list skbs before running XDP
  uprobes: Fix NULL pointer dereference in hprobe_expire()
  um: vector: fix use-after-free in vector_mmsg_rx()
  powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
  net: pktgen: fix proc entry use-after-free
  net: ipv6: clear suppressed fib6 rule result
  net: bridge: stop fast-leave after deleting a port group
  mm: memcg: initialize *locked in memcg1_oom_prepare() stub
  mm/page_reporting: use system_freezable_wq to fix UAF during suspend
  io_uring/net: initialize mshot_len for send
  binfmt_misc: don't let an 'F' entry pin its own instance
  binfmt_misc: reject a flag character as the field delimiter
  binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
  binfmt_misc: restore write access when removing an entry
  wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
  tipc: avoid use-after-free in poll trace queue dumps
  of/address: Fix NULL bus dereference in of_pci_range_parser_one()
  netfilter: ipset: do not update comments from kernel-side hash adds
  net/smc: fix socket use-after-free during link group termination
  mshv: fix hv_input_get_system_property struct
  ksmbd: reject repeated SMB2 NEGOTIATE requests
  ipvs: do not propagate one-packet flag to synced conns
  igc: remove napi_synchronize() in igc_down()
  igbvf: Fix leak in TX DMA error cleanup
  e1000: fix memory leak in e1000_probe()
  dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  ALSA: usb-audio: Clamp frame size in implicit-feedback mode
  ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
  ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
  ALSA: usb-audio: fix stack info leak in RME Digiface status
  ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
  ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  ASoC: tas2562: fix broken entries in the volume lookup table
  ASoC: tas2562: fix DVC coefficient write order
  ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
  ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
  ALSA: ump: fix double free of out_cvts on rawmidi error
  ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
  ALSA: seq: Fix division by zero in initialize_timer()
  ALSA: pcm: wake linked drain waiters on unlink
  ALSA: lx6464es: fix period byte count for 16-bit streams
  ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
  ALSA: 6fire: Fix UAF at error handling during probe
  afs: Fix UAF when sending a message
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix afs_fs_fetch_data() to set call->async
  bpf: lwt: Fix dst reference leak on reroute failure
  Bluetooth: HIDP: validate numbered report payloads
  Bluetooth: HIDP: reject frames without a transaction header
  Bluetooth: hci_sync: Fix advertising data UAFs
  Bluetooth: mgmt: fix UAF in pair command cancellation
  Bluetooth: SCO: give the socket its own sco_conn reference
  Bluetooth: mgmt: fix pending command UAF in EIR updates
  Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
  Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
  audit: fix potential use-after-free in audit_del_rule()
  audit: fix potential integer overflow in audit_log_n_string()
  sctp: validate Adaptation Indication parameter length
  dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
  KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
  KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
  KVM: s390: pci: Fix missing error codes and memory unaccounting
  KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
  KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
  KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
  KVM: VMX: add memory clobber to asm for VMX instructions
  tracing/fprobe: Roll back on enable_trace_fprobe() failure
  tracing/probes: Reject $arg0 in meta argument expansion
  mm/vmstat: fold stranded per-cpu node stats when a node comes online
  mm/hugetlb: fix list corruption in allocate_file_region_entries()
  mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
  selftest: fix headers in fclog.c
  mm/util: don't read __page_2 for order-1 folios in snapshot_page()
  mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
  fortify: Disable -Wstringop-overread in tests
  pinctrl: bm1880: add missing select GENERIC_PINCONF
  erofs: cap LZMA stream pool size
  pinctrl: devicetree: don't free uninitialized dev_name on error path
  pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
  iommu/iommufd: Fix IOPF group ownership UAF
  iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
  iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
  iommufd/viommu: Release the igroup lock on the vdevice_size error path
  mshv: Order pt_vp_array publish against irqfd assertion path
  mshv: Fix level-triggered check on uninitialized data
  mshv: adjust interrupt control structure for ARM64
  mshv: Fix race in mshv_irqfd_deassign
  iomap: add a separate bio_set for iomap_split_ioend
  ksmbd: fix use-after-free in __close_file_table_ids()
  ksmbd: return success for deferred final close
  drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
  sched/deadline: Use revised wakeup rule only for running dl_server
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
  accel/qaic: use sizeof(*trans_hdr) for transaction length check
  riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
  tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
  tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
  fprobe: Fix module reference count leak on error in register_fprobe()
  drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
  can: isotp: check register_netdevice_notifier() error in module init
  net: sxgbe: check descriptor ring allocation failures
  net: sxgbe: free TX rings on RX allocation failure
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  net: phylink: put link_gpio if phylink_create fails
  x86/boot: Add volatile, clobbers and zero-length test in memcmp()
  Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
  Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
  Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
  Bluetooth: btintel: Validate length before parsing diagnostics TLV
  Bluetooth: ISO: fix refcounting of iso_conn
  Bluetooth: ISO: ensure no dangling hcon references in iso_conn
  Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
  Bluetooth: ISO: fix leaking sk after socket release
  Bluetooth: ISO: hold sk properly in iso_conn_ready
  Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
  Bluetooth: ISO: Fix not updating BIS sender source address
  Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
  Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
  Bluetooth: ISO: lock sk in iso_connect_ind
  Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
  Bluetooth: HCI: Add initial support for PAST
  Bluetooth: ISO: lock sk in iso_sock_getname
  Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
  Bluetooth: ISO: clear iso_data always when detaching conn from hcon
  ice: suppress DPLL errors during reset recovery
  idpf: Fix mailbox IRQ name leak on request failure
  idpf: adjust TxQ ring count minimum
  hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
  net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
  netfs: release readahead folios on iterator preparation failure
  netfs: handle single writeback rolling buffer allocation failure
  netfs: clear PG_private_2 on copy-to-cache append failure
  wifi: mac80211: validate individual TWT params before driver setup
  net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
  powerpc/boot: Fix treeboot-akebono CPU node lookup check
  powerpc/boot: Fix treeboot-currituck CPU node lookup check
  powerpc/boot: Fix simpleboot CPU node lookup check
  rtase: fix double free of multi-frag skb on DMA map failure
  hwmon: (adt7470) Fix PWM auto temp state array and bounds check
  hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
  hwmon: (adt7470) Use cached PWM frequency value
  hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
  hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
  hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
  hwmon: (adt7470) Fix cache updated before hardware write on I2C error
  hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
  forcedeth: fix UAF of txrx_stats in nv_remove
  net: bridge: mrp: fix Option TLV length in MRP_Test frames
  hwmon: (nct6775-core) Prevent access to unsupported weight registers
  net: do not send ICMP/NDISC Redirects when peer allocation fails
  hwmon: (nzxt-smart2) DMA-align output buffer
  hwmon: (lm90) Only report alarms if driver is ready
  hwmon: (sht3x) Fix unaligned accesses
  hwmon: (ltc4282) Fix reading the minimum alarm voltage
  hwmon: (ina2xx) Fix various overflow issues
  hwmon: (ina2xx) Shift INA234 shunt and current registers
  hwmon: (ina2xx) Add support for INA234
  hwmon: (ina2xx) Make it easier to add more devices
  hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
  spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
  spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
  ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
  smb: client: fix buffer leaks in SMB1 read and write
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
  pinctrl-amd: Don't clear S4 wake bits at probe
  xsk: drain continuation descs after overflow in xsk_build_skb()
  xsk: use a smaller new lock for shared pool case
  xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
  selftests/net/af_unix: test listen() rejects wrong socket states
  selftest: af_unix: Create its own .gitignore.
  selftests: af_unix: Add tests for ECONNRESET and EOF semantics
  af_unix: fix listen() succeeding on sockets in the wrong state
  rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
  rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
  ASoC: SDCA: Ensure that Control Range is large enough for header
  netfilter: nft_payload: fix mask build for partial field offload
  ipvs: do not mangle ICMP replies for non-first fragments
  ipvs: fix places with wrong packet offsets
  ipvs: fix the checksum validations
  netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
  netfilter: nf_tables: make nft_object rhltable per table
  assoc_array: trim the final shortcut word using the current chunk end
  keys: make keyring key-chunk byte order agree with keyring_diff_objects()
  keys: fix out-of-bounds read in keyring_get_key_chunk()
  KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
  KVM: arm64: Reject guest_memfd memslots when the VM has MTE
  mshv: Fix sleeping under spinlock in mshv_portid_alloc
  mshv: Fix duplicate GSI detection for GSI 0
  Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
  Drivers: hv: Allocate the paravisor SynIC pages when required
  Drivers: hv: Rename fields for SynIC message and event pages
  arch/x86: mshyperv: Discover Confidential VMBus availability
  drm/mediatek: Check CRTC state before freeing
  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
  phy: zynqmp: fix runtime PM leak on probe allocation failure
  phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
  btrfs: raid56: fix an incorrect csum skip during scrub
  btrfs: zoned: reset meta_write_pointer on zone reset
  btrfs: zoned: fix deadlock between metadata writeback and transaction commit
  btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
  of: reserved_mem: prevent OOB when too many dynamic regions are defined
  ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
  ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
  phy: qcom: m31-eusb2: Fix return value of init call
  ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  ata: sata_mv: accept 1 or 2 resources in platform probe
  selftests/seccomp: Fix pointer type mismatch build error
  selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
  gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
  dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
  pinctrl: qcom: Unconditionally mark gpio as wakeup enable
  thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
  mm/slab: prevent unbounded recursion in free path with new kmalloc type
  lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
  HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
  HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
  HID: logitech-dj: Standardise hid_report_enum variable nomenclature
  ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
  drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
  net: mpls: initialize rtm_tos in mpls_getroute()
  netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
  kunit: tool: Terminate kernel under test on SIGINT
  kunit: tool: skip stty when stdin is not a tty
  netfilter: nf_conntrack_expect: restore helper propagation via expectation
  Linux 6.18.43
  x86/bugs: Make Safe-RET robust against interrupt injection
  Linux 6.18.42
  KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
  gpu: Fix uninitialized buddy for built-in drivers
  net: stmmac: fix dwmac4 transmit performance regression
  net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
  usb: gadget: f_tcm: synchronize delayed set_alt with teardown
  rust: device: avoid trailing ; in printing macros
  rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
  mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  mm/damon/core: validate ranges in damon_set_regions()
  i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization
  i3c: mipi-i3c-hci: Fix Hot-Join NACK
  pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
  pmdomain: imx93-blk-ctrl: convert to devm_* only
  net: ipa: fix SMEM state handle leaks in SMP2P init
  ata: libata-core: Reject an invalid concurrent positioning ranges count
  bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
  bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
  octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
  octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
  net: mana: Optimize irq affinity for low vcpu configs
  net: mana: Validate the packet length reported by the NIC
  fs/resctrl: Fix use-after-free during unmount
  fs/resctrl: Move RMID initialization to first mount
  fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]
  x86,fs/resctrl: Rename some L3 specific functions
  x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain
  fs/resctrl: Split L3 dependent parts out of __mon_event_count()
  mmc: vub300: fix use-after-free on probe failure
  mmc: vub300: rename probe error labels
  dm: avoid leaking the caller's thread keyring via the table device file
  cred: add kernel_cred() helper
  accel/amdxdna: reject command submission on devices without a submit op
  ovl: use linked upper dentry in copy-up tmpfile
  dmaengine: dw-edma-pcie: Reject devices without driver data
  dmaengine: dw-edma: Fix confusing cleanup.h syntax
  mtd: maps: vmu-flash: fix fault in unaligned fixup
  kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
  mm/sparse-vmemmap: fix vmemmap accounting underflow
  remoteproc: xlnx: Check remote core state
  cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
  cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c
  cxl/pci: Remove unnecessary CXL RCH handling helper functions
  cxl/pci: Remove unnecessary CXL Endpoint handling helper functions
  SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
  SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
  sunrpc: allocate a separate bvec array for socket sends
  NFSD: pass nfsd_file to nfsd_iter_read()
  pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
  gpu/buddy: bail out of try_harder when alignment cannot be honoured
  drm: drop lib from header search path.
  gpu: Move DRM buddy allocator one level up (part two)
  netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
  netfilter: nf_conntrack_sip: remove net variable shadowing
  netfilter: nft_fib: reject fib expression on the netdev egress hook
  netfilter: nf_tables: remove register tracking infrastructure
  arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
  arm64: dts: qcom: correct RBR opp entry
  VDUSE: avoid leaking information to userspace
  vduse: take out allocations from vduse_dev_alloc_coherent
  vduse: remove unused vaddr parameter of vduse_domain_free_coherent
  vduse: return internal vq group struct as map token
  xfs: don't replace the wrong part of the cow fork
  fuse-uring: fix race between registration and connection abortion
  audit: fix recursive locking deadlock in audit_dupe_exe()
  audit: use 'unsigned int' instead of 'unsigned'
  audit: widen ino fields to u64
  landlock: Account all audit data allocations to user space
  landlock: Fix formatting
  drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
  fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  ksmbd: validate ACE size against SID sub-authorities
  ksmbd: bound DACL dedup walk to copied ACEs
  ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
  ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  net: qrtr: ns: Raise node count limit to 512
  ublk: wait on ublk_dev_ready() instead of ub->completion
  drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
  dm-verity: fix buffer overflow in FEC calculation
  dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
  dm-verity-fec: fix reading parity bytes split across blocks (take 3)
  dm-verity-fec: fix the size of dm_verity_fec_io::erasures
  bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
  drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
  drm/amd/pm: fix smu13 power limit range calculation
  drm/amdgpu: fix aperture mapping leak
  drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
  drm/amdgpu: fix resource leak on ACP reset timeout
  drm/amdgpu: fix division by zero with invalid uvd dimensions
  drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
  drm/amdgpu/vcn4: avoid rereading IB param length
  drm/amdgpu/vce: fix integer overflow in image size
  drm/amdgpu/soc24: reset dGPU if suspend got aborted
  drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
  drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
  drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
  drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
  drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
  drm/amdgpu/gfx8: drop unecessary BUG_ON()
  drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
  drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
  drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
  drm/amd/pm: make pp_features read-only when scpm is enabled
  drm/amd/pm: fix amdgpu_pm_info power display units
  watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
  vxlan: mdb: Fix source list corruption on a failed replace
  vsock/virtio: collapse receive queue under memory pressure
  tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
  tcp: challenge ACK for non-exact RST in SYN-RECEIVED
  tcp: initialize standalone TCP-AO response padding
  rtase: Workaround for TX hang caused by hardware packet parsing
  pppoe: reload header pointer after dev_hard_header()
  ovpn: hold peer before scheduling keepalive work
  ovpn: fix peer refcount leak in TCP error paths
  openvswitch: fix GSO userspace truncation underflow
  mctp: serial: handle zero-length frames to prevent rx buffer overflow
  mac802154: llsec: reject frames shorter than the authentication tag
  mac802154: hold an interface reference across the scan worker
  ila: reload IPv6 header after pskb_may_pull in checksum adjust
  ice: use READ_ONCE() to access cached PHC time
  ice: reject out-of-range ptype in ice_parser_profile_init
  gve: fix Rx queue stall on alloc failure
  ksmbd: defer destroy_previous_session() until after NTLM authentication
  smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
  rbd: Reset positive result codes to zero in object map update path
  super: fix emergency thaw deadlock on frozen block devices
  ice: fix PTP Call Trace during PTP release
  ptp: ptp_s390: Add missing facility check
  s390/ptff: Export ptff_function_mask[]
  proc: Fix broken error paths for namespace links
  net: pcs: xpcs: fix SGMII state reading
  net: hip04: fix RX buffer leak on build_skb failure
  net: gro: fix double aggregation of flush-marked skbs
  net/x25: fix use-after-free in x25_kill_by_neigh()
  net/mlx5e: Use sender devcom for MPV master-up
  net/iucv: fix use-after-free of a severed iucv_path
  net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
  geneve: require CAP_NET_ADMIN in the device netns for changelink
  net: slip: serialize receive against buffer reallocation
  vxlan: require CAP_NET_ADMIN in the device netns for changelink
  phonet: pep: fix use-after-free in pep_get_sb()
  net: stmmac: intel: skip SerDes reconfig when rate is unchanged
  iommu/vt-d: Disallow SVA if page walk is not coherent
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  io_uring/rw: fix missing ERESTARTSYS conversion in read paths
  ftrace: Add global mutex to serialize trace_parser access
  fscrypt: Add missing superblock check in find_or_insert_direct_key()
  fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
  fs/super: fix emergency thaw double-unlock of s_umount
  binfmt_elf_fdpic: only honour the first PT_INTERP
  ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
  ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
  amt: fix use-after-free in AMT delayed works
  libceph: remove debugfs files before client teardown
  libceph: reject zero bucket types in crush_decode
  libceph: Reject monmaps advertising zero monitors
  libceph: refresh auth->authorizer_buf{,_len} after authorizer update
  libceph: guard missing CRUSH type name lookup
  libceph: Fix multiplication overflow in decode_new_up_state_weight()
  libceph: bound get_version reply decode to front len
  ceph: fix writeback_count leak in write_folio_nounlock()
  ceph: fix refcount leak in ceph_readdir()
  ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
  sctp: close UDP tunnel sockets during netns teardown
  sctp: avoid auth_enable sysctl UAF during netns teardown
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  mm/kmemleak: fix checksum computation for per-cpu objects
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: only set DATA_FIN when a mapping is present
  mptcp: decrement subflows counter on failed passive join
  Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
  arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
  arm64: make huge_ptep_get handled unaligned addresses
  tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
  tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
  tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
  tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
  tracing: Fix union collision of module and refcnt for dynamic events
  tracing: Fix resource leak on mmiotrace trace_pipe close
  tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  tracing: Fix context switch counter truncation
  misc: nsm: pin the module while the device is open
  misc: nsm: only unlock nsm_dev on post-lock error paths
  intel_th: fix MSC output device reference leak
  mei: bus: access mei_device under device_lock on cleanup
  selftests: ntsync: correct CONFIG_NTSYNC name
  serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
  serial: sc16is7xx: implement gpio get_direction() callback
  uio_hv_generic: Bind to FCopy device by default
  comedi: comedi_parport: deal with premature interrupt
  x86/boot/compressed: Disable jump tables
  firmware: stratix10-svc: fix memory leaks and list corruption bugs
  rhashtable: clear stale iter->p on table restart
  cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
  LoongArch: Retrieve CPU package ID from PPTT when available
  LoongArch: Move jump_label_init() before parse_early_param()
  LoongArch: Fix oops during single-step debugging
  LoongArch: Fix address space mismatch in kexec command line lookup
  objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
  rust: allow `clippy::unwrap_or_default` globally
  rust: time: fix as_micros_ceil() to round correctly for negative Delta
  rust_binder: only print failure if error has source
  platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
  binfmt_misc: set have_execfd only once the interpreter is opened
  exec: fix unsigned loop counter wrap in transfer_args_to_stack()
  Bluetooth: RFCOMM: Fix session UAF in set_termios
  Bluetooth: hci_sync: Protect UUID list traversal
  staging: rtl8723bs: fix inverted HT40 secondary channel offset
  staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
  wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
  wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
  wifi: brcmfmac: make release_scratchbuffers idempotent
  wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
  wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
  wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
  wifi: wilc1000: validate assoc response length before subtracting header
  wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
  wifi: ath6kl: fix use-after-free in aggr_reset_state()
  wifi: ath6kl: fix OOB access from firmware ADDBA window size
  ALSA: timer: don't re-enter an instance callback that is still running
  ALSA: timer: drain a slave's callback before its master detaches it
  ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
  ALSA: seq: close a re-opened queue timer in the destructor
  ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
  media: vpif_capture: fix OF node reference imbalance
  media: vivid: fix cleanup bugs in vivid_init()
  media: vivid: check for vb2_is_busy() when toggling caps
  media: vivid: add vivid_update_reduced_fps()
  media: vimc: fix reference leak on failed device registration
  media: vidtv: fix reference leak on failed device registration
  media: verisilicon: Export only needed pixels formats
  media: vb2: use ssize_t for vb2_read/vb2_write
  media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
  media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
  media: v4l2-ctrls: validate HEVC active reference counts
  media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
  media: ti: vpe: unwind v4l2 device registration on probe error
  media: tegra-video: vi: fix invalid u32 return value in format lookup
  media: synopsys: hdmirx: Fix HPD lane hold time
  media: sun4i-csi: Return queued buffers on start_streaming() failure
  media: stm32: dcmi: unregister notifier on probe failure
  media: stm32-dcmipp: Return queued buffers on start_streaming() failure
  media: saa7134: Fix a possible memory leak in saa7134_video_init1
  media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
  media: rtl2832_sdr: Return queued buffers on start_streaming() failure
  media: rtl2832: fix use-after-free in rtl2832_remove()
  media: radio-si476x: Unregister v4l2_device on probe failure
  media: qcom: camss: Fix RDI streaming for CSID GEN3
  media: qcom: camss: Fix RDI streaming for CSID GEN2
  media: qcom: camss: Fix RDI streaming for CSID 680
  media: pwc: Return queued buffers on start_streaming() failure
  media: pwc: Drain fill_buf on start_streaming() failure
  media: pci: dm1105: Free allocated workqueue
  media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
  media: nxp: imx8-isi: Fix potential out-of-bounds issues
  media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
  media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
  media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
  media: nuvoton: npcm-video: fix memory leaks in probe and remove
  media: nuvoton: npcm-video: fix error handling in npcm_video_init()
  media: msi2500: Return queued buffers on start_streaming() failure
  media: meson: vdec: Fix memory leak in error path of vdec_open
  media: marvell-cam: fix missing pci_disable_device() on remove
  media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
  media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges
  media: imx219: Fix maximum frame length in lines
  media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
  media: cx23885: add ioremap return check and cleanup
  media: cx231xx: fix devres lifetime
  media: chips-media: wave5: Move src_buf Removal to finish_encode
  media: cedrus: skip invalid H.264 reference list entries
  media: cedrus: Fix missing cleanup in error path
  media: cedrus: clean up media device on probe failure
  media: cec: seco: unregister adapter on IR probe failure
  media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
  media: amlogic-c3: Add validations for ae and awb config
  media: airspy: Return queued buffers on start_streaming() failure
  drm/v3d: Reach the GMP through the hub registers on V3D 7.x
  drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
  drm/vc4: Prevent shader BO mappings from becoming writable
  drm/vmwgfx: Validate vmw_surface_metadata::array_size
  drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
  drm/vc4: Shut down BO cache timer before teardown
  drm/amd/display: Fix flip-done timeouts on mode1 reset
  drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
  drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
  drm/amd/display: Fix backlight max_brightness to match exported range
  drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
  drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
  drm/amd/display: set new_stream to NULL after release
  drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
  drm/amdgpu: Fix VFCT bus number matching with soft filter
  drm/amdgpu: Release VFCT ACPI table reference
  drm/panthor: return error on truncated firmware
  drm/ttm: Account for NULL and handle pages in ttm_pool_backup
  drm/virtio: Don't detach GEM from a non-created context
  drm/gfx10: Program DB_RING_CONTROL
  drm/amd/pm: fix smu14 power limit range calculation
  drm/i915/mst: limit DP MST ESI service loop
  drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
  drm/i915/gem: Do not leak siblings[] on proto context error
  drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
  drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
  drm/i915/bios: range check LFP Data Block panel_type2
  drm/i915: Return NULL on error in active_instance
  drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
  drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
  drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
  drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
  drm/i915/hdcp: check streams[] bounds before overflow
  drm/i915/hdcp: require monotonically increasing seq_num_v
  drm/virtio: bound EDID block reads to the response buffer
  drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
  drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
  drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
  drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
  drm/amdkfd: Check bounds in allocate_event_notification_slot
  drm/amdkfd: Use kvcalloc to allocate arrays
  drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
  drm/imagination: fix error checking of pvr_vm_context_lookup()
  drm/imagination: Fix user array stride in pvr_set_uobj_array()
  drm/imagination: Fix double call to drm_sched_entity_fini()
  drm/xe: Hold a dma-buf reference for imported BOs
  drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
  drm/xe: Return error on non-migratable faults requiring devmem
  drm/radeon: fix r100_copy_blit for large BOs
  drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  drm/i915/gem: Add missing nospec on parallel submit slot
  drm/displayid: fix Tiled Display Topology ID size
  drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  drm/sysfb: Avoid possible truncation with calculating visible size
  drm/nouveau: fix reversed error cleanup order in ucopy functions
  drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
  drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
  drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
  drm/sysfb: Avoid truncating maximum stride
  drm/sysfb: Do not page-align visible size of the framebuffer
  drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
  drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
  drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
  drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
  drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
  drm/imagination: Fit paired fragment job in the correct CCCB
  drm/dp/mst: fix buffer overflows in sideband chunk accumulation
  drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
  drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
  drm/imagination: Count paired job fence as dependency in prepare_job()
  drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
  drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
  drm/tidss: Fix missing drm_bridge_add() call
  drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
  drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  ice: prevent tstamp ring allocation for non-PF VSI types
  ice: fix LAG recipe to profile association
  ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
  net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
  octeontx2-pf: tc: fix egress ratelimiting
  net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
  net/mlx5e: Report zero bandwidth for non-ETS traffic classes
  net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
  net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
  net/mlx5: Refactor EEPROM query error handling to return status separately
  raw: annotate lockless match fields in raw_v4_match()
  net: qrtr: restrict socket creation to the initial network namespace
  hinic: remove unused ethtool RSS user configuration buffers
  ppp: annotate data races in ppp_generic
  ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
  octeontx2-vf: set TC flower flag on MCAM entry allocation
  net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
  net: stmmac: enable the MAC on link up for all supported speeds
  net: stmmac: reset residual action in L3L4 filters on delete
  net: stmmac: fix l3l4 filter rejecting unsupported offload requests
  net: stmmac: xgmac: fix l4 filter port overwrite on register update
  net: stmmac: cores: remove many xxx_SHIFT definitions
  net: stmmac: socfpga: Add hardware supported cross-timestamp
  net: stmmac: socfpga: Enable TBS support for Agilex5
  net: stmmac: socfpga: Agilex5 EMAC platform configuration
  net: stmmac: remove xstats.pcs_* members
  bpf: tcp: fix double sock release on batch realloc
  drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
  tipc: fix u16 MTU truncation in media and bearer MTU validation
  iomap: correct the range of a partial dirty clear
  drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  drm/xe/i2c: Allow per domain unique id
  vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
  sctp: auth: verify auth requirement when auth_chunk is NULL
  net: dpaa: fix mode setting
  net: hsr: fix memory leak on slave unregistration by removing synced VLANs
  net: bridge: vlan: fix vlan range dumps starting with pvid
  amt: make the head writable before rewriting the L2 header
  amt: re-read skb header pointers after every pull
  ovl: check access to copy_file_range source with src mounter creds
  ovl: port ovl_copyfile() to cred guard
  ovl: add override_creds cleanup guard extension for overlayfs
  cred: add scoped_with_kernel_creds()
  drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
  ovl: fix trusted xattr escape prefix matching
  wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
  wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
  wifi: mt76: mt7925: fix crash in reset link replay
  wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
  wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
  wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
  wifi: mt76: mt7915: guard HE capability lookups
  wifi: mt76: mt7925: guard link STA in decap offload
  ppp: annotate concurrent dev->stats accesses
  ppp: don't store tx skb in the fastpath
  ppp: enable TX scatter-gather
  tipc: fix infinite loop in __tipc_nl_compat_dumpit
  nexthop: initialize extack in nh_res_bucket_migrate()
  gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
  selftests: drv-net: increase timeout
  selftests: ovpn: increase timeout
  selftests: ovpn: add IPV6 and VETH configs
  selftests: openvswitch: add config file
  selftests: af_unix: add USER_NS config
  tls: device: push pending open record on splice EOF
  net: mctp i3c: clean up notifier and buses if driver register fails
  sctp: validate stream count in sctp_process_strreset_inreq()
  pds_core: check for workqueue allocation failure
  pds_core: fix auxiliary device add/del races
  pds_core: order completion reads after the ownership check
  pds_core: yield the CPU while waiting for the adminq to drain
  pds_core: fix use-after-free on workqueue during remove
  pds_core: fix deadlock between reset thread and remove
  sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
  net: txgbe: fix FDIR filter leak on remove
  net: Call net_enable_timestamp() before failure in sk_clone().
  soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
  amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
  arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
  pds_core: reject component parameter in legacy firmware update
  wifi: mac80211: recalculate TIM when a station enters power save
  iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
  iommu/amd: Bound the early ACPI HID map
  wifi: mwifiex: bound uAP association event IEs to the event buffer
  vhost-net: fix TX stall when vhost owns virtio-net header
  wan: wanxl: Only reset hardware after BAR mapping
  nfp: Check resource mutex allocation
  wifi: mac80211: tear down new links on vif update error path
  iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
  net: airoha: Fix DMA direction for NPU mailbox buffer
  dpaa2-eth: put MAC endpoint device on disconnect
  net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
  dpaa2-switch: put MAC endpoint device on disconnect
  rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
  gtp: parse extension headers before reading inner protocol
  rds: drop incoming messages that cross network namespace boundaries
  bonding: fix devconf_all NULL dereference when IPv6 is disabled
  net/packet: avoid fanout hook re-registration after unregister
  netlink: specs: rt-link: convert bridge port flag attributes to u8
  net: phy: marvell: fix return code
  Bluetooth: btusb: validate Realtek vendor event length
  regulator: mt6358: use regmap helper to read fixed LDO calibration
  hwmon: occ: validate poll response sensor blocks
  ovpn: use monotonic clock for peer keepalive timeouts
  ovpn: fix use after free in unlock_ovpn()
  selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
  ovpn: avoid putting unrelated P2P peer on socket release
  smb: client: validate DFS referral PathConsumed
  hwmon: (asus-ec-sensors) add missed handle for ENOMEM
  hwmon: (asus-ec-sensors) fix EC read intervals
  hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
  drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
  usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
  wifi: iwlwifi: mvm: fix read in wake packet notification handler
  wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
  wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
  wifi: iwlwifi: mvm: validate SAR GEO response payload size
  ASoC: cs35l56: Use complete_all() to signal init_completion
  ASoC: cs35l56: Fix potential probe() deadlock
  ASoC: cs35l56: Don't use devres to unregister component
  ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
  ALSA: hda: cs35l41: validate and free ACPI mute object
  ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
  ASoC: tas2781: bound firmware description string parsing
  btrfs: free mapping node on duplicate reloc root insert
  btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
  btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
  btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
  wifi: carl9170: fix buffer overflow in rx_stream failover path
  wifi: carl9170: fix OOB read from off-by-two in TX status handler
  wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
  wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
  wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
  firewire: net: Fix fragmented datagram reassembly
  wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
  watchdog: airoha: Prevent division by zero when clock frequency is zero
  watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
  hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
  hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
  hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
  hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
  wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
  wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
  selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
  selftests/bpf: Adjust verifier_map_ptr for the map's excl field
  usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
  Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
  RISC-V: KVM: Serialize virtual interrupt pending state updates
  wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
  usb: typec: ucsi: Add duplicate detection to nvidia registration path
  usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
  USB: serial: option: add TDTECH MT5710-CN
  USB: serial: keyspan_pda: fix data loss on receive throttling
  USB: serial: io_edgeport: cap received transmit credits
  USB: serial: ftdi_sio: add support for E+H FXA291
  usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
  usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
  usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
  USB: gadget: fsl-udc: fix dev_printk() device
  USB: gadget: fsl-udc: fix device name leak on probe failure
  USB: gadget: snps-udc: fix device name leak on probe failure
  usb: gadget: printer: fix infinite loop in printer_read()
  usb: gadget: f_midi: cancel pending IN work before freeing the midi object
  usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
  usb: chipidea: fix usage_count leak when autosuspend_delay is negative
  USB: storage: add NO_ATA_1X quirk for Longmai USB Key
  usb: musb: omap2430: Do not put borrowed of_node in probe
  usb: core: port: Deattach Type-C connector on component unbind
  wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
  usb: core: sysfs: add lock to bos_descriptors_read()
  mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
  sctp: fix auth_hmacs array size in struct sctp_cookie
  net/sched: act_tunnel_key: Defer dst_release to RCU callback
  dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
  tcp: fix TIME_WAIT socket reference leak on PSP policy failure
  accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
  drm/i915/selftests: Fix GT PM sort comparators
  drm/i915/wm: clear the plane ddb_y entries on plane disable
  ksmbd: validate compound request size before reading StructureSize2
  ksmbd: pin conn during async oplock break notification
  drm/xe/wopcm: fix WOPCM size for LNL+
  drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
  drm/xe/vf: Shadow buffer management for CCS read/write operations
  drm/xe/sa: Shadow buffer support in the sub-allocator pool
  drm/xe: Allow the caller to pass guc_buf_cache size
  can: j1939: fix lockless local-destination check
  riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
  s390/checksum: Fix csum_partial() without vector facility
  drm/panthor: Check debugfs GEM lock initialization
  bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  powerpc/vtime: Initialize starttime at boot for native accounting
  powerpc/time: Prepare to stop elapsing in dynticks-idle
  powerpc/85xx: Add fsl,ifc to common device ids
  can: raw: add locking for raw flags bitfield
  drm/i915/gt: use correct selftest config symbol
  smb/client: handle overlapping allocated ranges in fallocate
  Bluetooth: hci_qca: Clear memdump state on invalid dump size
  Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
  Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
  Bluetooth: hci_sync: extend conn_hash lookup critical sections
  Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
  Bluetooth: qca: fix NVM tag length underflow in TLV parser
  ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
  accel/ivpu: Fix wrong register read in LNL failure diagnostics
  ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
  ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
  ata: sata_dwc_460ex: use platform_get_irq()
  ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
  scsi: core: wake eh reliably when using scsi_schedule_eh
  udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
  net/iucv: take a reference on the socket found in afiucv_hs_rcv()
  ipv4: fib: free fib_alias with kfree_rcu() on insert error path
  ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
  cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
  firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
  ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
  ASoC: cs42l43: Correct report for forced microphone jack
  ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
  ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
  ASoC: amd: ps: disable MSI on resume in ACP PCI driver
  ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
  firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
  firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
  wifi: cfg80211: bound element ID read when checking non-inheritance
  wifi: brcmfmac: initialize SDIO data work before cleanup
  wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
  wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
  wifi: cfg80211: reject unsupported PMSR FTM location requests
  wifi: cfg80211: validate PMSR FTM preamble range
  wifi: cfg80211: validate PMSR measurement type data
  wifi: nl80211: constrain MBSSID TX link ID range
  wifi: nl80211: validate nested MBSSID IE blobs
  wifi: cfg80211: derive S1G beacon TSF from S1G fields
  wifi: nl80211: free RNR data on MBSSID mismatch
  wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
  wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
  wifi: mac80211: defer link RX stats percpu free to RCU
  wifi: libertas: fix memory leak in helper_firmware_cb()
  wifi: mac80211: fix fils_discovery double free on alloc failure
  wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
  wifi: mac80211_hwsim: clamp virtio RX length before skb_put
  wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
  wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
  wifi: cfg80211: cancel sched scan results work on unregister
  xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
  xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
  xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
  xfrm: clear mode callbacks after failed mode setup
  RDMA/irdma: Prevent overflows in memory contiguity checks
  selftests/alsa: Fix memory leak in find_controls error path
  mtd: fix double free and WARN_ON in add_mtd_device() error paths
  RDMA/siw: publish QP after initialization
  RDMA/hns: Fix potential integer overflow in mhop hem cleanup
  RDMA/mana_ib: initialize err for empty send WR lists
  RDMA/erdma: initialize ret for empty receive WR lists
  RDMA/irdma: Prevent user-triggered null deref on QP create
  RDMA/irdma: Remove redundant legacy_mode checks
  RDMA/irdma: Prevent rereg_mr for non-mem regions
  RDMA/umem: Add pinned revocable dmabuf import interface
  RDMA/cma: Fix hardware address comparison length in netevent callback
  xfrm: reject optional IPTFS templates in outbound policies
  sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next
  firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
  btrfs: fallback to transaction csum tree on a commit root csum miss
  btrfs: use bool type for btrfs_path members used as booleans
  btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
  btrfs: reject free space cache with more entries than pages
  mtd: nand: mtk-ecc: stop on ECC idle timeouts
  mtd: mtdswap: remove debugfs stats file on teardown
  IB/mad: Drop unmatched RMPP responses before reassembly
  firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  xfrm: fix stale skb->prev after async crypto steals a GSO segment
  xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
  net: plumb drop reasons to __dev_queue_xmit()
  net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
  arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
  arm64: tegra: Remove fallback compatible for GPCDMA
  fuse: fix writeback array overflow when max_pages is one
  Input: ims-pcu - fix logic error in packet reset
  Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
  xprtrdma: Clear receive-side ownership pointers on release
  crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
  gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
  dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
  can: bcm: track a single source interface for ANYDEV timeout/throttle ops
  can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
  can: bcm: fix stale rx/tx ops after device removal
  can: bcm: add missing device refcount for CAN filter removal
  can: bcm: validate frame length in bcm_rx_setup() for RTR replies
  can: bcm: extend bcm_tx_lock usage for data and timer updates
  can: bcm: fix CAN frame rx/tx statistics
  can: bcm: add locking when updating filter and timer values
  KVM: x86/mmu: Fix use-after-free on vendor module reload
  KVM: nVMX: Hide shadow VMCS right after VMCLEAR
  KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
  KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
  seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
  seqlock: Allow KASAN to fail optimizing
  seqlock: Cure some more scoped_seqlock() optimization fails
  fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
  drm/virtio: fix deadlock in display_info_cb by remo…
@qswat-orbit-external

Copy link
Copy Markdown

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

@qlijarvis

Copy link
Copy Markdown

PR #970 — validate-patch

PR: #970

Verdict Issues Detailed Report
0 Full report

Final Summary

  1. Lore link present: No — no lore.kernel.org Link tags found in pr.patch (per lore_evidence/README.md)

  2. Lore link matches PR commits: N/A — no lore links to compare against; cannot validate diff faithfulness

  3. Upstream patch status: N/A — no upstream attribution provided; cannot determine acceptance status

  4. PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence

Verdict: ❌ — click to expand

🔍 Patch Validation

PR: #970 (title unavailable - network restricted)
Upstream commit: N/A
Verdict: ❌ FAIL

Commit Message

Check Status Note
Subject matches upstream No commit subject found (empty string)
Body preserves rationale No commit message body available
Fixes tag present/correct No Fixes tag found
Authorship preserved No author information in raw diff format
Backport note (if applicable) N/A Not applicable - no upstream reference

Diff

File Status Notes
Makefile Version bump: SUBLEVEL 37→44 without commit context
Documentation/* (multiple) 88,826 files changed without attribution
arch/* (multiple) Massive tree-wide changes without commit message
drivers/* (multiple) No lore links or commit prefixes to validate against

Issues

Critical Issues:

  1. No commit message or subject — The PR contains a raw diff with no git commit metadata. Cannot validate commit message correctness, authorship, or trailers.

  2. No lore.kernel.org links — Per lore_evidence/README.md: "no lore.kernel.org Link tags found in pr.patch". The validate-patch skill requires a lore link to perform validation. Without upstream attribution, this PR cannot be validated for:

    • Faithful representation of upstream patches
    • Correct authorship preservation
    • Proper commit message formatting
    • Upstream acceptance status
  3. Missing commit prefix — No UPSTREAM:, FROMLIST:, BACKPORT:, QCLINUX:, or other standard prefix found. Cannot determine the intended upstream relationship.

  4. Partial integration presence — Per integration_presence_report.md:

    • Status: PARTIAL
    • 1,118,271 lines checked, 42,372 lines missing from qcom-next
    • 42,537 lines missing from topics/baseline
    • Missing samples include: Makefile version bump (SUBLEVEL = 44), MAINTAINERS updates, sc7280.dtsi OPP entries, and others
  5. Massive scope without structure — 4,992,702 lines in the diff, 88,826 files changed. This appears to be a merge or rebase commit that should be broken down into properly attributed individual commits with lore links.

Verdict

REJECT — This PR cannot be validated or merged in its current form.

Required corrections:

  1. Split into atomic commits — Break this massive diff into individual, logically grouped commits, each with:

    • A descriptive subject line following kernel style
    • A commit body explaining the change rationale
    • Proper authorship (From: line)
    • Appropriate commit prefix (UPSTREAM:, FROMLIST:, BACKPORT:, etc.)
    • Link: tag pointing to lore.kernel.org for upstream patches
  2. Add lore attribution — For each commit that originates from upstream:

    • Include Link: https://lore.kernel.org/r/<message-id> in the commit message
    • Preserve original authorship
    • Add Signed-off-by: trailers
  3. Document vendor-only changes — For Qualcomm-specific changes with no upstream equivalent:

    • Use QCLINUX: prefix
    • Provide clear rationale in commit body
    • No lore link required
  4. Resolve integration gaps — Investigate the 42k missing lines:

    • Determine if these are intentional differences
    • Document why they differ from qcom-next/topics
    • Ensure version bumps (Makefile SUBLEVEL) are appropriate

Final Summary

  1. Lore link present: No — no lore.kernel.org Link tags found in pr.patch (per lore_evidence/README.md)

  2. Lore link matches PR commits: N/A — no lore links to compare against; cannot validate diff faithfulness

  3. Upstream patch status: N/A — no upstream attribution provided; cannot determine acceptance status

  4. PR present in qcom-next/topics: Partial — 1/1 commit has partial integration evidence (1,118,271 lines present, 42,372-42,537 lines missing across qcom-next and topics/baseline). Missing samples include Makefile version bump, MAINTAINERS updates, and sc7280.dtsi OPP entries.

Deterministic Integration Presence

Integration Presence Report

This report is generated by Jarvis before validate-patch runs.
It is the authoritative source for whether PR changes are already present
in qcom-next or in the kernel topic branches.

Kernel repo: /local/mnt/workspace/sgaud/Qgenie/image_pipeline/kernel
qcom-next ref: 3c1e80ceb9fb6978aa94bc0624e7c0003f3b4f6e
topics remote: topics -> https://github.com/qualcomm-linux/kernel-topics
topics fetch: fetched

Commit Subject qcom-next topics Final
1/1 `` partial - subject or partial tree evidence found, but full change was not verified partial - subject or partial tree evidence found, but full change was not verified partial

Final Status

overall_status: PARTIAL
present_commits: 0/1
partial_commits: 1/1
missing_commits: 0/1
topics_checked_for_commits: 1/1
final_summary: PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence

@qlijarvis

Copy link
Copy Markdown

PR #970 — checker-log-analyzer

PR: #970
Checker run: https://github.com/qualcomm-linux/kernel-config/actions/runs/32331976782

Checker Result Summary
Checker Result Summary
checkpatch Merge conflict during setup
dt-binding-check Merge conflict during setup
dtb-check Merge conflict during setup
sparse-check Merge conflict during setup
check-uapi-headers Merge conflict during setup
check-patch-compliance Merge conflict during setup
tag-check ⏭️ Cannot run - merge conflict blocks analysis

Detailed report: Full report

Checker analysis — click to expand

🤖 CI Checker Analysis (checker-log-analyzer)

PR: #970 (title unknown - logs only)
Target branch: qcom-6.18.y
Source: https://github.com/qualcomm-linux/kernel-config/actions/runs/32331976782

Checker Result Summary
checkpatch Merge conflict during setup
dt-binding-check Merge conflict during setup
dtb-check Merge conflict during setup
sparse-check Merge conflict during setup
check-uapi-headers Merge conflict during setup
check-patch-compliance Merge conflict during setup
tag-check ⏭️ Cannot run - merge conflict blocks analysis

❌ All Checkers — Merge Conflict During CI Setup

Root cause: The CI automerge process failed when attempting to merge PR #970 (targeting qcom-6.18.y) with the qcom-next baseline. A merge conflict occurred in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c, preventing all checker jobs from running.

Failure details:

2026-08-20T04:44:12.6674220Z CONFLICT (content): Merge conflict in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
2026-08-20T04:44:12.7277884Z Automatic merge failed; fix conflicts and then commit the result.
2026-08-20T04:44:12.7417950Z Merge failed or conflicts detected. Aborting merge.
2026-08-20T04:44:14.4207612Z ##[error]Process completed with exit code 3.

This failure occurred during the CI setup phase before any actual checker validation could run. The CI workflow performs an automerge operation that:

  1. Checks out qcom-next as the baseline
  2. Runs automerge to integrate topic branches
  3. Attempts to merge the PR branch on top

The merge conflict at step 3 blocked all subsequent checker execution.

Fix: Resolve the merge conflict in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

Option 1 — Rebase the PR locally:

# In your local kernel tree
git fetch origin qcom-next
git checkout pr-970-branch
git rebase origin/qcom-next

# Resolve conflicts in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
# Edit the file, remove conflict markers, stage the resolution
git add drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
git rebase --continue

# Force-push the rebased branch
git push --force-with-lease

Option 2 — Use the resolve-conflict skill (if available in your environment):

$resolve-conflict

Option 3 — Investigate the conflict manually:

# Reproduce the conflict locally
git fetch origin qcom-next pr-970-branch
git checkout qcom-next
git merge --no-commit pr-970-branch

# Examine the conflict
git diff drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

Why this happened:
The PR targets qcom-6.18.y, but the CI checker workflow uses qcom-next as the integration baseline for validation. Changes in amdgpu_dm.c between qcom-6.18.y and qcom-next are incompatible with the changes in this PR, causing a three-way merge conflict.

Note on tag-check:
Since the target branch is qcom-6.18.y (not qcom-next or qcom-next-staging), the subject-prefix check (tag-check) would normally be mandatory — every commit must start with FROMLIST:, FROMGIT:, UPSTREAM:, BACKPORT:, QCLINUX:, PENDING:, or WORKAROUND:. However, this check cannot be performed until the merge conflict is resolved and the checkers can run.


Verdict

Cannot merge — blocker must be fixed first.

The merge conflict in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c must be resolved before any checker validation can proceed. Once resolved:

  1. Re-trigger the CI run
  2. All checkers will execute
  3. Additional issues (if any) will be reported in a subsequent run

Immediate action required: Rebase PR #970 onto qcom-next and resolve the conflict in amdgpu_dm.c.

@qswat-orbit-external

Copy link
Copy Markdown

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

@qcomlnxci

Copy link
Copy Markdown

Test Matrix

Test Case hamoa-iot-evk-multimedia lemans-evk-multimedia monaco-evk-multimedia purwa-iot-evk-multimedia qcs615-ride-multimedia qcs6490-rb3gen2-multimedia qcs8300-ride-multimedia qcs9100-ride-r3-multimedia shikra-iqs-evk-multimedia
Audio_Card_Registration ⚠️ skip ✅ Pass ✅ Pass ◻️ ⚠️ skip ⚠️ skip ⚠️ skip ◻️ ⚠️ skip
BT_FW_KMD_Service ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_ON_OFF ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_SCAN ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
CPUFreq_Validation ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
CPU_affinity ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
DSP_AudioPD ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
Ethernet_Basic_Validation ⚠️ skip ✅ Pass ✅ Pass ◻️ ⚠️ skip ⚠️ skip ❌ Fail ◻️ ⚠️ skip
Freq_Scaling ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
GIC ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail
IPA ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
Interrupts ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
KVM_Driver ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_EL2_DTB ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_Infra ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
OpenCV ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
PCIe ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
Probe_Failure_Check ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
RMNET ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
UFS_Validation ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
USBHost ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail
WiFi_Firmware_Driver ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
WiFi_OnOff ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
adsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
cdsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
gpdsp_remoteproc ⚠️ skip ✅ Pass ✅ Pass ◻️ ⚠️ skip ⚠️ skip ✅ Pass ◻️ ⚠️ skip
hotplug ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
irq ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
kaslr ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
pinctrl ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
qcom_hwrng ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ◻️
rngtest ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
shmbridge ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
smmu ❌ Fail ❌ Fail ✅ Pass ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass
watchdog ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
wpss_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass

@nsiddams

Copy link
Copy Markdown
Author

dp_display.c

These macros were removed as part of https://lore.kernel.org/all/20250808-hpd-refactor-v2-8-7f4e1e741aa3@oss.qualcomm.com/

None of these changes are needed.

Updated the change

@riteshk-quic

Copy link
Copy Markdown

Approved for dp_display.c

@qcomlnxci

Copy link
Copy Markdown

Test Matrix

Test Case hamoa-iot-evk-multimedia lemans-evk-multimedia monaco-evk-multimedia purwa-iot-evk-multimedia qcs615-ride-multimedia qcs6490-rb3gen2-multimedia qcs8300-ride-multimedia qcs9100-ride-r3-multimedia shikra-iqs-evk-multimedia
Audio_Card_Registration ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip ✅ Pass ⚠️ skip ◻️ ⚠️ skip
BT_FW_KMD_Service ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_ON_OFF ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
BT_SCAN ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
CPUFreq_Validation ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
CPU_affinity ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
DSP_AudioPD ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
Ethernet_Basic_Validation ⚠️ skip ✅ Pass ✅ Pass ◻️ ⚠️ skip ⚠️ skip ⚠️ skip ◻️ ⚠️ skip
Freq_Scaling ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ❌ Fail ✅ Pass ◻️ ✅ Pass
GIC ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ❌ Fail ✅ Pass ◻️ ❌ Fail
IPA ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
Interrupts ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
KVM_Driver ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_EL2_DTB ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
KVM_Infra ❌ Fail ✅ Pass ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
OpenCV ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
PCIe ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
Probe_Failure_Check ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail
RMNET ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
UFS_Validation ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
USBHost ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail
WiFi_Firmware_Driver ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
WiFi_OnOff ✅ Pass ✅ Pass ❌ Fail ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
adsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ⚠️ skip
cdsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
gpdsp_remoteproc ⚠️ skip ✅ Pass ✅ Pass ◻️ ⚠️ skip ⚠️ skip ✅ Pass ◻️ ⚠️ skip
hotplug ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
irq ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
kaslr ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
pinctrl ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
qcom_hwrng ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ◻️
rngtest ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
shmbridge ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
smmu ❌ Fail ❌ Fail ✅ Pass ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass
watchdog ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass
wpss_remoteproc ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass

@qcomlnxci

Copy link
Copy Markdown

Test Matrix

Test Case hamoa-iot-evk-multimedia lemans-evk-multimedia monaco-evk-multimedia purwa-iot-evk-multimedia qcs615-ride-multimedia qcs6490-rb3gen2-multimedia qcs8300-ride-multimedia qcs9100-ride-r3-multimedia shikra-iqs-evk-multimedia
Audio_Card_Registration ✅ Pass ✅ Pass ✅ Pass ✅ Pass ⚠️ skip ✅ Pass ⚠️ skip ⚠️ skip ⚠️ skip
BT_FW_KMD_Service ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
BT_ON_OFF ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
BT_SCAN ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
CPUFreq_Validation ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
CPU_affinity ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
DSP_AudioPD ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
Ethernet_Basic_Validation ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip ⚠️ skip ⚠️ skip ❌ Fail ❌ Fail ⚠️ skip
Freq_Scaling ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ❌ Fail ✅ Pass ✅ Pass ✅ Pass
GIC ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ❌ Fail ✅ Pass ✅ Pass ❌ Fail
IPA ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
Interrupts ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
KVM_Driver ❌ Fail ✅ Pass ✅ Pass ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail
KVM_EL2_DTB ❌ Fail ✅ Pass ✅ Pass ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail
KVM_Infra ❌ Fail ✅ Pass ✅ Pass ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail
OpenCV ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
PCIe ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
Probe_Failure_Check ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail ❌ Fail
RMNET ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
UFS_Validation ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
USBHost ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ❌ Fail ❌ Fail ❌ Fail ❌ Fail
WiFi_Firmware_Driver ✅ Pass ✅ Pass ❌ Fail ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
WiFi_OnOff ✅ Pass ✅ Pass ❌ Fail ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
adsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
cdsp_remoteproc ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
gpdsp_remoteproc ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip ⚠️ skip ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip
hotplug ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
irq ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
kaslr ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
pinctrl ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
qcom_hwrng ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ◻️
rngtest ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
shmbridge ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
smmu ❌ Fail ❌ Fail ✅ Pass ❌ Fail ❌ Fail ✅ Pass ✅ Pass ❌ Fail ✅ Pass
watchdog ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass
wpss_remoteproc ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass ✅ Pass

@qlijarvis

Copy link
Copy Markdown

PR #970 — validate-patch

PR: #970

Verdict Issues Detailed Report
0 Full report

Final Summary

  1. Lore link present: No — no lore.kernel.org link found in pr.patch (per lore_evidence/README.md)
  2. Lore link matches PR commits: N/A — no lore link to compare against; patch has no commit structure
  3. Upstream patch status: N/A — cannot determine without lore link or commit metadata
  4. PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence
Verdict: ❌ — click to expand

🔍 Patch Validation

PR: #970 (title unknown - network restricted)
Upstream commit: N/A
Verdict: ❌ FAIL

Commit Message

Check Status Note
Subject matches upstream No commit message present in pr.patch
Body preserves rationale No commit message present in pr.patch
Fixes tag present/correct No commit message present in pr.patch
Authorship preserved No commit metadata (From/Author) present
Backport note (if applicable) N/A No commit message to evaluate

Diff

File Status Notes
94,677 files modified Massive unified diff with no commit structure
Makefile (appears 33 times) Duplicate/overlapping changes suggest malformed patch
SUBLEVEL 37→44 ⚠️ Appears to be stable kernel version bump (v6.12.37 → v6.12.44)

Issues

Critical structural problems:

  1. No commit metadata — pr.patch is a raw unified diff with no From:, Subject:, Date:, or commit message headers. This violates kernel patch submission standards.

  2. No lore.kernel.org link — Per lore_evidence/README.md: "no lore.kernel.org Link tags found in pr.patch". The validate-patch skill requires a lore link to verify patch integrity. Without one, validation cannot proceed.

  3. Malformed patch structure — The same file (e.g., Makefile) is modified 33 times within the same patch, suggesting either:

    • Multiple commits were concatenated without proper git format-patch boundaries
    • A merge conflict resolution was exported as a raw diff
    • The patch was generated incorrectly
  4. Massive scope — 94,677 files changed across ~5M lines. This scale is consistent with a stable kernel merge (v6.12.37 → v6.12.44) but should be represented as a merge commit, not a unified diff.

  5. Partial integration presence — Per integration_presence_report.md: "PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence". The report shows 1,118,832 added lines present but 41,712 lines missing from qcom-next, with missing samples in Documentation/, MAINTAINERS, Makefile, and arch/arm64/boot/dts/qcom/sc7280.dtsi.

Verdict

Do not merge. This PR cannot be validated because:

  1. It lacks the required lore.kernel.org link (mandatory per validate-patch skill Step 1)
  2. It has no commit message or metadata to review
  3. The patch structure is malformed (duplicate file modifications)
  4. It cannot be verified against upstream sources

If this is a stable kernel merge (v6.12.37 → v6.12.44):

  • Use git merge to create a proper merge commit, not git diff
  • The merge commit message should reference the stable release tag
  • Individual stable commits should preserve their original authorship and commit messages
  • No lore link is needed for a merge commit itself, but constituent commits should have proper attribution

If this is a backport series:

  • Split into individual commits with proper git format-patch structure
  • Each commit must have: From, Date, Subject, commit body, and Link: tag pointing to lore.kernel.org
  • Use appropriate prefixes: UPSTREAM:, BACKPORT:, or FROMLIST:

Final Summary

  1. Lore link present: No — no lore.kernel.org link found in pr.patch (per lore_evidence/README.md)
  2. Lore link matches PR commits: N/A — no lore link to compare against; patch has no commit structure
  3. Upstream patch status: N/A — cannot determine without lore link or commit metadata
  4. PR present in qcom-next/topics: Partial — 1,118,832/1,160,544 added lines present (96.4%); 41,712 lines missing including changes to sc7280.dtsi, Makefile, MAINTAINERS, Documentation/ (per integration_presence_report.md)

Deterministic Integration Presence

Integration Presence Report

This report is generated by Jarvis before validate-patch runs.
It is the authoritative source for whether PR changes are already present
in qcom-next or in the kernel topic branches.

Kernel repo: /local/mnt/workspace/sgaud/Qgenie/image_pipeline/kernel
qcom-next ref: 3c1e80ceb9fb6978aa94bc0624e7c0003f3b4f6e
topics remote: topics -> https://github.com/qualcomm-linux/kernel-topics
topics fetch: fetched

Commit Subject qcom-next topics Final
1/1 `` partial - subject or partial tree evidence found, but full change was not verified partial - subject or partial tree evidence found, but full change was not verified partial

Final Status

overall_status: PARTIAL
present_commits: 0/1
partial_commits: 1/1
missing_commits: 0/1
topics_checked_for_commits: 1/1
final_summary: PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence

@qlijarvis

Copy link
Copy Markdown

PR #970 — checker-log-analyzer

PR: #970
Checker run: https://github.com/qualcomm-linux/kernel-config/actions/runs/32747138731

Checker Result Summary
Checker Result Summary
checkpatch ⚠️ Minor warnings (Reported-by/Closes, commit description style, email mismatches)
dt-binding-check All binding checks passed
dtb-check Pre-existing tree issues (Allwinner, MediaTek, Nvidia Tegra234)
sparse-check No sparse warnings
check-uapi-headers UAPI ABI breakage in btrfs headers
check-patch-compliance All 3297 commits missing required prefix (expected for stable merge)
tag-check N/A Not applicable for stable release merges

Detailed report: Full report

Checker analysis — click to expand

🤖 CI Checker Analysis (checker-log-analyzer)

PR: #970 - Linux 6.18.44 stable release merge
Source: https://github.com/qualcomm-linux/kernel-config/actions/runs/32747138731

Checker Result Summary
checkpatch ⚠️ Minor warnings (Reported-by/Closes, commit description style, email mismatches)
dt-binding-check All binding checks passed
dtb-check Pre-existing tree issues (Allwinner, MediaTek, Nvidia Tegra234)
sparse-check No sparse warnings
check-uapi-headers UAPI ABI breakage in btrfs headers
check-patch-compliance All 3297 commits missing required prefix (expected for stable merge)
tag-check N/A Not applicable for stable release merges

❌ check-uapi-headers

Root cause: UAPI ABI breakage detected in include/linux/btrfs.h — the buf[] array element type changed from __u64 to __u8 in struct btrfs_ioctl_search_args_v2.

Failure details:

==== ABI differences detected in include/linux/btrfs.h from dc0f4d4280a7 -> f9d3c5dfa71e ====
    [C] 'struct btrfs_ioctl_search_args_v2' changed:
      type size hasn't changed
      1 data member change:
        type of '__u64 buf[]' changed:
          array element type 'typedef __u64' changed:
            typedef name changed from __u64 to __u8 at int-ll64.h:21:1
            underlying type 'unsigned long long int' changed:
              type name changed from 'unsigned long long int' to 'unsigned char'
              type size changed from 64 to 8 (in bits)
          type name changed from '__u64[]' to '__u8[]'
          type size hasn't changed

Analysis: This is a genuine UAPI ABI breakage introduced by one of the 3297 commits in the Linux 6.18.44 stable release. The btrfs_ioctl_search_args_v2 structure's buf[] field changed its element type from __u64 (8 bytes) to __u8 (1 byte). While the total array size hasn't changed, this breaks binary compatibility for userspace programs that expect __u64 elements.

Fix: This requires investigation of which commit in the stable release introduced this change. The change may be intentional (a fix) or unintentional (a regression). Check the btrfs commits in the 6.18.44 release notes and verify if this is a known issue.

Reproduce locally:

./scripts/check-uapi.sh -b f9d3c5dfa71e2c90b7cc5e9c6769f1a3cafe51ce -p dc0f4d4280a7ecfcf8bc2d6bff1f42b1b8d33b08 -l uapi_errors.log

❌ dtb-check

Root cause: Pre-existing devicetree validation errors in Allwinner, MediaTek, and Nvidia Tegra234 platforms — these are not introduced by this PR.

Failure details:

# Allwinner sun55i pinctrl (4 DTBs affected):
pinctrl@2000000 (allwinner,sun55i-a523-pinctrl): interrupts: [[0, 67, 4], ...] is too long

# MediaTek mt8192 PCIe (2 DTBs affected):
pcie@11230000 (mediatek,mt8192-pcie): Unevaluated properties are not allowed ('memory-region' was unexpected)

# Nvidia Tegra234 MGBE ethernet (multiple DTBs affected):
ethernet@6800000 (nvidia,tegra234-mgbe): clock-names:3: 'ptp-ref' was expected

Analysis: These are recurring tree-wide issues documented in the skill's log-patterns reference (Section 8). They exist in the baseline tree and are exposed when new DTBs are built. The checker's baseline subtraction should have filtered these out, but they appear in the log, indicating either:

  1. The base build was incomplete, or
  2. These errors were introduced in a previous merge and are now being flagged

Fix: These are not blockers for this PR. They should be fixed in separate patches targeting the affected platform DTS/binding files:

  • Allwinner: Update allwinner,sun55i-a523-pinctrl.yaml to allow more interrupt entries
  • MediaTek: Add memory-region to mediatek-pcie-gen3.yaml properties
  • Nvidia: Add ptp-ref clock to Tegra234 MGBE ethernet nodes

Reproduce locally:

make -j$(nproc) O=out CHECK_DTBS=y arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dtb
make -j$(nproc) O=out CHECK_DTBS=y arch/arm64/boot/dts/mediatek/mt8192-asurada-hayato-r1.dtb
make -j$(nproc) O=out CHECK_DTBS=y arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dtb

❌ check-patch-compliance

Root cause: All 3297 commits in the Linux 6.18.44 stable release lack the required subject-line prefix (FROMLIST:, FROMGIT:, UPSTREAM:, BACKPORT:, etc.).

Failure details:

Checking commit: KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit summary does not start with a required prefix

Checking commit: lsm: add backing_file LSM hooks
Commit summary does not start with a required prefix

... (3297 total failures)

Checking commit: Linux 6.18.44
Commit summary does not start with a required prefix

Analysis: This is expected behavior for a stable release merge. The check-patch-compliance checker enforces that every commit must start with a prefix like UPSTREAM:, FROMLIST:, etc. However, stable release commits from kernel.org are imported as-is without modification.

Fix: For a stable release merge, there are two options:

  1. Accept as-is (recommended): Stable releases are authoritative upstream sources and don't require prefix modification. The checker limitation is known.
  2. Rewrite all 3297 commits (not recommended): Prepend UPSTREAM: to every commit subject, but this breaks traceability to the original stable release and complicates future merges.

Note: The skill documentation (Section 2.6) explicitly states: "QCLINUX: and PENDING: prefixes always fail check-patch-compliance — this is a known checker limitation for vendor-only commits." The same limitation applies to unmodified stable release merges.


⚠️ checkpatch

Root cause: Minor style warnings in a small subset of commits (not blockers).

Failure details:

  • Reported-by: should be immediately followed by Closes: — Several commits have Reported-by: without a Closes: link
  • From:/Signed-off-by: email address mismatch — Author Wenjie Qi has different emails in From: vs Signed-off-by:
  • Prefer a maximum 75 chars per line — A few commit messages have long lines
  • ERROR: Please use git commit description style — One commit references another commit incorrectly

Analysis: These are minor style issues inherited from the upstream stable release. They do not affect functionality.

Fix: Not required for a stable release merge. These commits are imported from kernel.org and should not be modified.


Verdict

This is a Linux 6.18.44 stable release merge with 3297 commits.

Blockers:

  1. check-uapi-headers UAPI ABI breakage — The btrfs_ioctl_search_args_v2 structure change is a genuine ABI break that must be investigated. Verify if this is intentional (a fix in the stable release) or a regression.

Non-blockers:

  • check-patch-compliance — Expected failure for stable merges (all 3297 commits lack prefix)
  • dtb-check — Pre-existing tree issues in Allwinner/MediaTek/Nvidia platforms (not introduced by this PR)
  • checkpatch — Minor style warnings inherited from upstream (acceptable for stable merges)

Recommendation:
Investigate the btrfs UAPI change before merging. If the ABI break is intentional and documented in the 6.18.44 release notes, proceed with merge. Otherwise, consider excluding the problematic btrfs commit(s) or waiting for a fix in a subsequent stable release.

@qlijarvis

Copy link
Copy Markdown

LAVA Failed Case Triage Summary

PR: #970

Job 212437 | SoC monaco-evk

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212437

Failed test cases in LAVA job 212437 (SoC: monaco-evk).

  Case 1: Probe_Failure_Check (4 genuine failures; 2 suppressed as benign)
  1. Failed case: Probe_Failure_Check (4 genuine failures; 2 suppressed as benign)
  2. Root cause: ath11k_pci WiFi driver probe timeout (-110) after firmware load failure on monaco-evk (SM8275); PR970 modifies ath11k PCI driver code and likely introduced a regression in the probe/initialization path causing the WCN6855 WiFi module to fail enumeration.
  3. Possible fix: Revert or debug the ath11k driver changes in PR970 (drivers/net/wireless/ath/ath11k/pci.c, ahb.c, dp.c, dp_rx.c); verify firmware path /lib/firmware/ath11k/WCN6855/hw2.1/nfa765/amss.bin exists in rootfs; add regulatory.db to firmware package; cpufreq-dt -EEXIST and BT firmware errors are benign and require no action.
  4. Detail analysis attachment: failed_case_job212437_1_detailed.md
  Case 2: WiFi_Firmware_Driver
  1. Failed case: WiFi_Firmware_Driver
  2. Root cause: ath11k_pci driver probe timeout (-110 ETIMEDOUT) on monaco-evk WCN6855 WiFi device after PR Merge tag 'v6.18.44' into qcom-6.18.y #970 modified ath11k_pci_soc_global_reset() to add PCI posted-write flush operations, which altered reset timing and caused MHI firmware load failure (amss.bin -2 ENOENT) followed by probe timeout.
  3. Possible fix: Revert the ath11k/pci.c changes from PR Merge tag 'v6.18.44' into qcom-6.18.y #970 or adjust the reset delay timing in ath11k_pci_soc_global_reset() to account for the additional latency introduced by the read-back flush operations — increase the mdelay(delay) value from 10ms to 20-50ms after each flush to allow the WCN6855 device sufficient time to complete reset and respond to MHI firmware requests.
  4. Detail analysis attachment: failed_case_job212437_2_detailed.md
  Case 3: WiFi_OnOff
  1. Failed case: WiFi_OnOff
  2. Root cause: Could not be determined confidently from available logs.
  3. Possible fix: Add the missing WCN6855 nfa765 firmware binary (ath11k/WCN6855/hw2.1/nfa765/amss.bin) to the rootfs image build recipe for monaco-evk. Verify the firmware package (e.g., linux-firmware-ath11k or equivalent) includes the nfa765 variant and is installed in the Yocto/build configuration for this target.
  4. Detail analysis attachment: failed_case_job212437_3_detailed.md
  Case 4: 0_qcom-next-ci-premerge-tests
  1. Failed case: 0_qcom-next-ci-premerge-tests
  2. Root cause: LAVA test infrastructure marked the test definition as failed because WiFi test cases (WiFi_Firmware_Driver and WiFi_OnOff) failed due to ath11k_pci probe timeout (error -110) caused by missing firmware file (ath11k/WCN6855/hw2.1/nfa765/amss.bin) on monaco-evk platform.
  3. Possible fix: This is a test infrastructure/firmware packaging issue, not a kernel regression. The PR changes to ath11k_pci.c (adding flush reads after global reset) may have exposed a pre-existing timing sensitivity in the monaco-evk WiFi hardware initialization. Verify firmware files are present in the test image rootfs at /lib/firmware/ath11k/WCN6855/hw2.1/nfa765/. If firmware is present, the PCI flush reads may need timing adjustment for this specific platform.
  4. Detail analysis attachment: failed_case_job212437_4_detailed.md
Job 212438 | SoC purwa-evk

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212438

Failed test cases in LAVA job 212438 (SoC: purwa-evk).

  Case 1: Build Load Failure — HTTP download timeout
  1. Failed case: Build Load Failure — HTTP download timeout
  2. Root cause: Result: Build Load Failure. The LAVA dispatcher's HTTP download action timed out after 2396 seconds (39m56s) while downloading a 1033 MB build artifact from AWS S3. The download reached only 35% (361 MB) before the configured timeout was exceeded. The exact error string is "http-download timed out after 2396 seconds".
  3. Possible fix: Re-trigger the CI job; if the timeout recurs, increase the http-download timeout from 2396s (39m56s) to at least 7200s (2 hours) and the download-retry block timeout from 2396s to match in the LAVA job definition. Additionally, investigate network bandwidth between the LAVA worker and AWS S3 us-west-2 region, as the observed download rate (~9 MB/min) is abnormally slow for a 1 GB file transfer.
  4. Detail analysis attachment: failed_case_job212438_1_detailed.md
  Case 2: Build Load Failure — HTTP download timeout
  1. Failed case: Build Load Failure — HTTP download timeout
  2. Root cause: Result: Build Load Failure. The LAVA dispatcher's http-download action timed out after 2396 seconds (39 minutes 56 seconds) while downloading a 1033 MB build artifact from AWS S3. The download reached only 35% (361 MB) before the timeout, indicating severely degraded network throughput (~150 KB/s average) between the LAVA worker and the S3 artifact server. The error type is "Infrastructure", confirming this is a LAVA lab infrastructure issue, not a kernel or PR-introduced problem.
  3. Possible fix: Re-trigger the CI job; if the timeout recurs, increase the http-download timeout from 2396s (~40min) to 7200s (2 hours) and the download-retry block timeout from 00:39:56 to 02:30:00 in the LAVA job definition to accommodate the 1 GB+ artifact size over slow network links. Additionally, investigate network path performance between the LAVA worker (board serial FTA9W2BQ, purwa-evk SoC) and qli-prd-kernel-gh-artifacts.s3.us-west-2.amazonaws.com to identify bottlenecks.
  4. Detail analysis attachment: failed_case_job212438_2_detailed.md
  Case 3: ** Build Load Failure — HTTP download timeout
  1. Failed case: ** Build Load Failure — HTTP download timeout
  2. Root cause: ** Result: Build Load Failure. The LAVA dispatcher's HTTP download of the 1033 MB root filesystem image from S3 (qcom-multimedia-image-iq-x5121-evk.rootfs.qcomflash.tar.gz) timed out after 2396 seconds (39m56s) at 35% completion (361 MB transferred). Network transfer rate was extremely slow (averaging ~150 KB/s for the first 20%, then briefly accelerating before stalling completely at 35%). The error type Infrastructure indicates a LAVA lab-side issue, not a build artifact problem.
  3. Possible fix: Re-trigger the CI job; if the timeout recurs, increase the http-download action timeout from 2396s (00:39:56) to at least 3600s (1 hour) and the parent download-retry block timeout from 2400s to 4000s in the LAVA job definition. Additionally, investigate S3 bucket throttling limits and LAVA worker network path to AWS us-west-2 region for the purwa-evk board (serial FTA9W2BQ, debugboard 'tac').
  4. Detail analysis attachment: failed_case_job212438_3_detailed.md
  Case 4: ** Build Load Failure — HTTP download timeout
  1. Failed case: ** Build Load Failure — HTTP download timeout
  2. Root cause: ** Result: Build Load Failure. The LAVA dispatcher's HTTP download of the 1033 MB rootfs image (qcom-multimedia-image-iq-x5121-evk.rootfs.qcomflash.tar.gz) from the S3 artifact server timed out after 2396 seconds (39m56s) at 35% completion (361 MB downloaded). Network connectivity was intermittent: initially very slow (~5-7 MB/min for 0-20%), briefly fast (~2500 MB/min for 20-35%), then completely stalled for the final 3m44s until timeout. The kernel never booted.
  3. Possible fix: Re-trigger the CI job to rule out transient network issues. If the failure recurs, increase the http-download action timeout from the current 2396s (~40min) to 3600s (60min) and increase the download-retry block timeout proportionally in the LAVA job definition to accommodate the large 1033 MB image size over potentially slow/unstable network paths. Additionally, investigate S3 bucket network path stability and consider enabling download resume/chunking if supported by the LAVA dispatcher.
  4. Detail analysis attachment: failed_case_job212438_4_detailed.md
Job 212439 | SoC qcs8300-ride

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212439

Failed test cases in LAVA job 212439 (SoC: qcs8300-ride).

  Case 1: Probe_Failure_Check — Pre-existing Platform Issues (Not PR-Introduced)
  1. Failed case: Probe_Failure_Check — Pre-existing Platform Issues (Not PR-Introduced)
  2. Root cause: Two pre-existing platform-specific probe failures on qcs8300-ride: (1) regulatory.db firmware file missing from rootfs (benign — cfg80211 falls back to built-in certificates), and (2) Aquantia AQR115C Ethernet PHY probe failure due to missing firmware-name DT property (error -22 / -EINVAL), a known board-specific configuration issue unrelated to this PR's changes (documentation, cpufreq, crypto, DT bindings, and PHY driver fixes for Marvell/Realtek/SFP — no Aquantia driver modifications).
  3. Possible fix: Mark this test failure as a false positive for PR validation purposes. The regulatory.db warning is cosmetic (WiFi/BT functional tests passed). The Aquantia PHY probe failure requires a separate board-level fix: add the missing firmware-name property to the qcs8300-ride DTS ethernet PHY node, or confirm the PHY firmware is not required for this board configuration and suppress the error in the driver.
  4. Detail analysis attachment: failed_case_job212439_1_detailed.md
  Case 2: USBHost — Test Infrastructure Issue
  1. Failed case: USBHost — Test Infrastructure Issue
  2. Root cause: The USBHost test expects at least one functional USB device to be connected to the qcs8300-ride board's USB host port, but only the USB 2.0 root hub (Bus 001 Device 001: ID 1d6b:0002) is enumerated. The kernel USB host controller (xhci-hcd at 0x0a400000) initialized successfully and the USB stack is functional, but no external USB devices are physically connected to the test board.
  3. Possible fix: This is a test infrastructure/lab setup issue, not a kernel regression. The PR contains no USB host driver changes for qcs8300 (USB changes in the patch are limited to ipq5424 device tree node address corrections). Re-run the test with a USB device (e.g., USB flash drive, keyboard, or mouse) physically connected to the board's USB host port, or mark this test as expected-fail for boards without permanently attached USB peripherals.
  4. Detail analysis attachment: failed_case_job212439_2_detailed.md
  Case 3: Ethernet_Basic_Validation — Driver Probe Failure (PHY Attachment)
  1. Failed case: Ethernet_Basic_Validation — Driver Probe Failure (PHY Attachment)
  2. Root cause: The qcom-ethqos Ethernet driver (st_gmac) at 23040000.ethernet on qcs8300-ride fails to attach to the PHY during interface bring-up due to phylink validation failure of 2500base-x mode. The PHY advertises link modes (0x000062c0) that are incompatible with the MAC's supported capabilities (0x000062cc) for 2500base-x, resulting in -EINVAL from phylink_validate(). This is a platform-specific configuration mismatch between the PHY capabilities advertised in device tree and the MAC driver's supported link modes, not a regression introduced by PR Merge tag 'v6.18.44' into qcom-6.18.y #970.
  3. Possible fix: This is a pre-existing platform configuration issue on qcs8300-ride, not introduced by PR Merge tag 'v6.18.44' into qcom-6.18.y #970 (which contains no qcom-ethqos, qcs8300, phylink validation, or 2500base-x capability changes). The PR can proceed to merge. To fix the underlying board issue: (1) verify the PHY device tree node's max-speed property and phy-mode are correctly set for the installed PHY hardware on qcs8300-ride; (2) check if the qcom-ethqos driver's mac_capabilities in drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c correctly declares 2500base-x support for this SoC variant; (3) if the PHY hardware does not support 2500base-x, update the device tree to use phy-mode = "rgmii" or sgmii and remove max-speed = <2500> if present.
  4. Detail analysis attachment: failed_case_job212439_3_detailed.md
  Case 4: KVM_Driver
  1. Failed case: KVM_Driver
  2. Root cause: /dev/kvm device node is not created despite CONFIG_KVM being enabled in the kernel configuration. On qcs8300-ride (Monaco SoC), KVM requires hardware virtualization support (EL2/VHE) which may not be available or enabled in the firmware/bootloader configuration for this platform. The KVM ARM64 driver successfully compiles into the kernel but does not initialize at runtime because the platform does not meet the hardware prerequisites for KVM operation (CPU must support virtualization extensions and boot at EL2).
  3. Possible fix: This is a platform limitation, not a kernel regression. The qcs8300-ride platform either lacks hardware virtualization support or the bootloader is not configured to enable EL2. To resolve: (1) verify the SoC supports ARM virtualization extensions (check CPU features for "VHE" or check if CPU boots to EL2); (2) if supported, ensure the bootloader (ABL/XBL) is configured to boot the kernel at EL2 instead of EL1; (3) if the platform fundamentally does not support virtualization, mark KVM tests as "not applicable" for qcs8300-ride in the CI test matrix rather than treating this as a failure.
  4. Detail analysis attachment: failed_case_job212439_4_detailed.md
  Case 5: KVM_EL2_DTB — KVM device node unavailable (pre-existing platform limitation)
  1. Failed case: KVM_EL2_DTB — KVM device node unavailable (pre-existing platform limitation)
  2. Root cause: /dev/kvm device node is not present on QCS8300 Ride (Monaco) platform because KVM/hypervisor support is not initialized at EL2 on this SoC. CONFIG_KVM is enabled in the kernel configuration, but the KVM driver did not create /dev/kvm, indicating that the platform either does not support virtualization extensions at the hardware/firmware level, or the hypervisor mode (EL2) is not accessible to the kernel on this board configuration.
  3. Possible fix: This is a pre-existing platform limitation, not a regression introduced by PR Merge tag 'v6.18.44' into qcom-6.18.y #970. The PR changes are related to KVM code (GICv3 LR count, nested virtualization, MTE capability checks, and address size fault codes) but do not affect KVM initialization or device node creation. No fix is required for the PR. If KVM support is required on QCS8300 Ride, verify: (1) the SoC/board supports ARM virtualization extensions (VHE/nVHE), (2) the bootloader/firmware boots the kernel at EL2 or allows EL2 access, (3) the device tree includes any required hypervisor/virtualization nodes, and (4) check for any KVM initialization error messages in the full dmesg log that may indicate why KVM did not probe successfully.
  4. Detail analysis attachment: failed_case_job212439_5_detailed.md
  Case 6: KVM_Infra — Platform Configuration Limitation
  1. Failed case: KVM_Infra — Platform Configuration Limitation
  2. Root cause: KVM cannot initialize on qcs8300-ride because the system is running under the Gunyah hypervisor, which occupies EL2 (hypervisor mode). KVM requires EL2 access to create /dev/kvm and enable virtualization, but EL2 is already owned by Gunyah. This is an expected architectural limitation, not a kernel bug or PR-introduced regression.
  3. Possible fix: Update the LAVA KVM test suite to detect hypervisor presence (check for "Hypervisor cold boot.*gunyah" in dmesg) and skip KVM tests with a SKIP result instead of FAIL when running under Gunyah. Add a test gate in Runner/suites/Virtualization/KVM/*/run.sh before checking for /dev/kvm.
  4. Detail analysis attachment: failed_case_job212439_6_detailed.md
  Case 7: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: KVM driver initialization failure on qcs8300-ride — CONFIG_KVM is enabled but /dev/kvm device node is not created; PR introduces changes to init_subsystems() that access hyp_gicv3_nr_lr symbol during VGIC initialization, likely causing silent initialization failure on this SoC where GICv3 configuration may differ from expected.
  3. Possible fix: Verify that hyp_gicv3_nr_lr symbol is properly initialized before use in init_subsystems(); add error handling and logging around the new code at line 2327 in arch/arm64/kvm/arm.c that accesses kvm_nvhe_sym(hyp_gicv3_nr_lr); check if static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) condition is correctly evaluating on qcs8300-ride; add defensive check to ensure kvm_vgic_global_state.nr_lr is valid before assignment.
  4. Detail analysis attachment: failed_case_job212439_7_detailed.md
Job 212440 | SoC hamoa-evk

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212440

Failed test cases in LAVA job 212440 (SoC: hamoa-evk).

  Case 1: Probe_Failure_Check — Deferred probe loop and hard probe failures
  1. Failed case: Probe_Failure_Check — Deferred probe loop and hard probe failures
  2. Root cause: Pinctrl driver 6e80000.pinctrl is stuck in deferred probe state, causing cascading deferrals for all audio subsystem devices (soundwire controllers, codecs, sound card) that depend on its pinctrl states; additionally, three drivers have hard probe failures: qcom_qseecom_uefisecapp (-EBUSY), qcom-spmi-lpg (-EINVAL), and regulatory.db firmware load (-ENOENT).
  3. Possible fix: Investigate why 6e80000.pinctrl (TLMM pinctrl) is deferring probe on hamoa-evk — check device tree for missing clock/regulator/power-domain dependencies or incorrect phandle references; for the hard failures, qseecom -EBUSY indicates TrustZone resource conflict (expected on some platforms), lpg -EINVAL suggests DT property mismatch, and regulatory.db -ENOENT is a known benign firmware warning that can be ignored.
  4. Detail analysis attachment: failed_case_job212440_1_detailed.md
  Case 2: ** smmu (Test Expectation Mismatch — Not a Kernel Crash)
  1. Failed case: ** smmu (Test Expectation Mismatch — Not a Kernel Crash)
  2. Root cause: ** Test expects USB wrapper devices (a0f8800.usb, a2f8800.usb, a4f8800.usb, a6f8800.usb, a8f8800.usb) and video codec device (aa00000.video-codec) to have IOMMU group attachments, but these devices either do not have drivers on hamoa-evk platform or are parent/wrapper nodes that do not perform DMA and do not require IOMMU protection. The actual USB controllers and all other critical masters are correctly protected by SMMU. No SMMU hardware faults or kernel errors present.
  3. Possible fix: Update the smmu test's device list for hamoa-evk platform to exclude USB wrapper devices (addresses ending in f8800) and aa00000.video-codec, or mark them as optional. The test should only validate devices that actually probe and perform DMA operations.
  4. Detail analysis attachment: failed_case_job212440_2_detailed.md
  Case 3: KVM_Driver — /dev/kvm not available (driver initialization failure)
  1. Failed case: KVM_Driver — /dev/kvm not available (driver initialization failure)
  2. Root cause: KVM driver initialization failed during kernel boot because ARM EL2 (Hypervisor mode) is not available on the Hamoa IoT EVK platform. The kernel message "kvm [1]: HYP mode not available" at boot time (6.373361s) indicates the CPU is not running in or does not support EL2, which is a prerequisite for KVM/ARM virtualization. This is a platform hardware/firmware limitation, not a kernel software issue.
  3. Possible fix: This is not a PR-introduced regression. The Hamoa IoT EVK platform does not support ARM virtualization (EL2/HYP mode), either due to hardware limitations or firmware configuration that boots the kernel at EL1 without EL2 access. To enable KVM on this platform: (1) verify the SoC hardware supports virtualization extensions, (2) ensure the bootloader (ABL/UEFI) boots the kernel at EL2 or with EL2 accessible, (3) check secure firmware (TZ) configuration to ensure EL2 is not disabled. If the hardware does not support EL2, KVM tests should be skipped for this platform in CI. Add platform-specific test skip logic for hamoa-evk in the LAVA test definition.
  4. Detail analysis attachment: failed_case_job212440_3_detailed.md
  Case 4: KVM_EL2_DTB — KVM initialization failure
  1. Failed case: KVM_EL2_DTB — KVM initialization failure
  2. Root cause: KVM cannot initialize because Gunyah hypervisor (gunyah-mobile-c487961e9) is already running at EL2 on hamoa-evk, preventing KVM from taking control of HYP mode; kernel log shows "kvm [1]: HYP mode not available" at boot.
  3. Possible fix: This is a platform configuration issue, not a kernel regression. The hamoa-evk board boots with Gunyah hypervisor by default, which occupies EL2 and prevents KVM from initializing. To enable KVM testing on this platform: (1) boot without Gunyah hypervisor (requires bootloader/firmware configuration change to disable Gunyah), OR (2) exclude KVM tests from the hamoa-evk test suite since this platform is configured for Gunyah virtualization, not KVM.
  4. Detail analysis attachment: failed_case_job212440_4_detailed.md
  Case 5: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: Could not be determined confidently from available logs.
  3. Possible fix: This is expected behavior on hamoa-evk with Gunyah hypervisor; to enable KVM testing, either (1) use a different platform without Gunyah, (2) boot hamoa-evk without Gunyah hypervisor (requires firmware/bootloader configuration change), or (3) mark KVM tests as expected-to-skip on hamoa-evk in the CI test matrix.
  4. Detail analysis attachment: failed_case_job212440_5_detailed.md
  Case 6: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: KVM infrastructure test failed because the hamoa-evk platform is running under Gunyah hypervisor (detected at boot: "Hypervisor cold boot, version: gunyah-mobile-c487961e9"), which prevents KVM from initializing in nested virtualization mode, resulting in "kvm [1]: HYP mode not available" and no /dev/kvm device node creation.
  3. Possible fix: This is a platform configuration issue, not a kernel regression. The hamoa-evk board runs Gunyah hypervisor by default, which occupies EL2 and prevents KVM (which also requires EL2) from running. To enable KVM testing on this platform: (1) disable Gunyah hypervisor in the firmware/bootloader configuration, OR (2) exclude KVM tests from the hamoa-evk test suite, OR (3) use a different platform without a pre-existing hypervisor for KVM validation.
  4. Detail analysis attachment: failed_case_job212440_6_detailed.md
Job 212441 | SoC qcs6490-rb3gen2

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212441

Failed test cases in LAVA job 212441 (SoC: qcs6490-rb3gen2).

  Case 1: Probe_Failure_Check
  1. Failed case: Probe_Failure_Check
  2. Root cause: Test false positive — reports deferred probe chains and missing optional firmware as failures on qcs6490-rb3gen2 where audio hardware is not configured in DT and regulatory.db/renesas USB firmware are not included in rootfs
  3. Possible fix: Suppress known-benign probe failures in Probe_Failure_Check test: (1) deferred probe entries when no corresponding hard probe failure exists, (2) regulatory.db firmware load failure when WiFi functional tests pass, (3) xhci-pci-renesas probe failure on platforms without Renesas USB firmware
  4. Detail analysis attachment: failed_case_job212441_1_detailed.md
  Case 2: USBHost — Driver Probe Failure (USB Host Controller)
  1. Failed case: USBHost — Driver Probe Failure (USB Host Controller)
  2. Root cause: On-SoC USB host controllers (8c00000.usb, a600000.usb) are present in device tree and registered with IOMMU but no USB host controller driver (dwc3-qcom/xhci-hcd) is probing them; the only USB controller probe attempt was for a PCIe-attached Renesas xHCI (0001:04:00.0) which failed due to missing firmware (renesas_usb_fw.mem, error -2/ENOENT); qcs6490-rb3gen2 requires dwc3-qcom driver to initialize on-SoC USB controllers for host mode functionality.
  3. Possible fix: Enable CONFIG_USB_DWC3_QCOM=y (or =m and ensure module is loaded) in the kernel configuration to probe the on-SoC Qualcomm DWC3 USB controllers at 8c00000.usb and a600000.usb; verify the driver probes successfully and creates xhci-hcd host controller instances; optionally install renesas_usb_fw.mem firmware to /lib/firmware/ if the PCIe USB controller is intended to be used.
  4. Detail analysis attachment: failed_case_job212441_2_detailed.md
  Case 3: KVM_Driver
  1. Failed case: KVM_Driver
  2. Root cause: Could not be determined confidently from available logs.
  3. Possible fix: Suppress KVM tests for qcs6490-rb3gen2 in CI by adding it to the test exclusion list in the LAVA test definition. Long-term: work with Qualcomm firmware team to enable EL2 in the bootloader/TrustZone configuration. To verify after firmware update: check dmesg | grep kvm shows "Hyp mode initialized successfully" and confirm /dev/kvm exists.
  4. Detail analysis attachment: failed_case_job212441_3_detailed.md
  Case 4: KVM_EL2_DTB — /dev/kvm unavailable (HYP mode not available)
  1. Failed case: KVM_EL2_DTB — /dev/kvm unavailable (HYP mode not available)
  2. Root cause: The qcs6490-rb3gen2 (Kodiak) platform boots without EL2/HYP mode available, causing KVM initialization to fail with "HYP mode not available" at boot time (line 2960), which prevents /dev/kvm device node creation and causes all KVM-dependent tests to fail.
  3. Possible fix: This is a pre-existing platform configuration issue, not a PR-introduced regression. To enable KVM on qcs6490-rb3gen2: (1) verify the bootloader (ABL/XBL) is configured to boot Linux at EL2 instead of EL1, (2) ensure the hypervisor firmware (hypvm.mbn) is present and correctly loaded, (3) check that the platform's TrustZone configuration allows EL2 execution, or (4) if the hardware does not support virtualization extensions, mark KVM tests as "not applicable" for this platform in the CI test matrix.
  4. Detail analysis attachment: failed_case_job212441_4_detailed.md
  Case 5: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: Could not be determined confidently from available logs.
  3. Possible fix: This is a pre-existing platform limitation, not a PR-introduced regression. To enable KVM on qcs6490-rb3gen2: (1) Update board firmware (ABL/UEFI) to boot Linux at EL2 instead of EL1, or (2) Exclude KVM tests from the CI test suite for this SoC, as it does not support virtualization in its current firmware configuration. No kernel code changes are required.
  4. Detail analysis attachment: failed_case_job212441_5_detailed.md
  Case 6: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: Platform limitation — qcs6490-rb3gen2 (Kodiak) does not support ARM EL2 (Hypervisor mode), which is required for KVM functionality; kernel correctly detected and reported "HYP mode not available" at boot.
  3. Possible fix: Mark KVM_Infra test as expected-fail or skip for qcs6490-rb3gen2 platform in the LAVA test definition; alternatively, exclude KVM tests from the test suite for platforms without EL2 support.
  4. Detail analysis attachment: failed_case_job212441_6_detailed.md
Job 212442 | SoC qcs9100-ride

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212442

Failed test cases in LAVA job 212442 (SoC: qcs9100-ride).

  Case 1: Kernel Crash — Synchronous External Abort (SMMU Hardware Access Fault)
  1. Failed case: Kernel Crash — Synchronous External Abort (SMMU Hardware Access Fault)
  2. Root cause: The qcs9100-ride platform experienced a synchronous external abort at PC qcom_smmu_write_s2cr+0x84/0x140 during SMMU (System MMU) device probe at boot. The fault occurred when the qcom-smmu driver attempted to write to the S2CR (Stream-to-Context Register) at address ffff800084000c28 (x19 register), indicating the SMMU hardware register block is either not powered, not clocked, or the memory-mapped region is inaccessible due to platform-specific power/clock/interconnect configuration issues on qcs9100-ride.
  3. Possible fix: This is a pre-existing platform bring-up issue specific to qcs9100-ride, not introduced by PR Merge tag 'v6.18.44' into qcom-6.18.y #970 (which only modifies arm-smmu-v3 iommufd code and documentation, not qcom-smmu or qcs9100 device tree). Verify qcs9100-ride device tree SMMU node power-domain, clock, and interconnect properties; confirm SMMU power rails and clocks are enabled before driver probe; check if qcs9100-ride requires platform-specific SMMU initialization sequence or firmware dependencies not present in the test environment.
  4. Detail analysis attachment: failed_case_job212442_1_detailed.md
  Case 2: ** Kernel Crash — Synchronous External Abort during SMMU Initialization
  1. Failed case: ** Kernel Crash — Synchronous External Abort during SMMU Initialization
  2. Root cause: ** The kernel crashes with a synchronous external abort (bus error) when the ARM SMMU driver attempts to write to the S2CR (Stream-to-Context Register) at offset 0xc28 during arm_smmu_device_probe. The SMMU hardware block on qcs9100-ride either: (1) is not powered/clocked correctly, (2) has incorrect register base address mapping in the device tree, (3) is held in reset, or (4) has secure firmware blocking non-secure S2CR writes. This is a pre-existing platform/board configuration issue, not a regression introduced by PR Merge tag 'v6.18.44' into qcom-6.18.y #970 (the PR does not modify ARM SMMU v1/v2 driver code).
  3. Possible fix: Verify qcs9100-ride SMMU device tree configuration: (1) Confirm SMMU register base address and size in DT match hardware spec, (2) Verify SMMU power domain and clock bindings are correct and enabled before probe, (3) Check if secure firmware (TZ/XBL) has configured SMMU security policy to allow non-secure S2CR writes, (4) Compare with a known-good qcs9100 DTB to identify missing or incorrect properties. If this is a lab-specific board issue, re-trigger the CI job on a different qcs9100-ride board to confirm hardware health.
  4. Detail analysis attachment: failed_case_job212442_2_detailed.md
  Case 3: Kernel Crash — Synchronous External Abort in SMMU Driver
  1. Failed case: Kernel Crash — Synchronous External Abort in SMMU Driver
  2. Root cause: Synchronous external abort (hardware fault) at qcom_smmu_write_s2cr+0x84/0x140 during ARM SMMU driver probe on qcs9100-ride; the SMMU driver attempted to write to S2CR registers but triggered a bus fault, indicating either unmapped/inaccessible SMMU MMIO region, incorrect device tree SMMU register base address, or hardware/firmware issue preventing SMMU register access during early boot.
  3. Possible fix: Verify the SMMU device tree node register base addresses and ranges match the qcs9100 hardware specification; check that SMMU power/clock domains are enabled before driver probe; if the PR introduced SMMU DT changes, revert and validate; otherwise, this is a pre-existing platform/firmware issue — check bootloader/TZ firmware versions and SMMU hardware initialization state.
  4. Detail analysis attachment: failed_case_job212442_3_detailed.md
  Case 4: Kernel Crash — SMMU synchronous external abort during S2CR register write
  1. Failed case: Kernel Crash — SMMU synchronous external abort during S2CR register write
  2. Root cause: Synchronous external abort (bus error) at PC qcom_smmu_write_s2cr+0x84/0x140 during SMMU device probe on qcs9100-ride; the SMMU driver attempted to write to an S2CR register at an invalid or unpowered MMIO address (base + offset 0xc28), triggering a hardware bus fault that escalated to kernel panic.
  3. Possible fix: Verify SMMU device tree node for qcs9100-ride has correct reg property mapping all required SMMU register banks; confirm SMMU power domain is enabled before driver probe; if PR introduces SMMU DT or driver changes, revert and validate base SMMU functionality on this SoC first.
  4. Detail analysis attachment: failed_case_job212442_4_detailed.md
Job 212443 | SoC qcs615-ride

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212443

Failed test cases in LAVA job 212443 (SoC: qcs615-ride).

  Case 1: Probe_Failure_Check — Benign firmware load warning (not a genuine failure)
  1. Failed case: Probe_Failure_Check — Benign firmware load warning (not a genuine failure)
  2. Root cause: The Probe_Failure_Check test flagged a cfg80211 regulatory.db firmware load failure (error -2 = file not found) that occurred during boot. This is a benign, expected condition on systems without the optional regulatory.db file installed. The kernel falls back to built-in regulatory rules, and WiFi functionality is unaffected (confirmed by passing WiFi_Firmware_Driver and WiFi_OnOff tests). This is not a PR-introduced regression.
  3. Possible fix: Suppress this specific regulatory.db failure in the Probe_Failure_Check test logic, as it is a known benign condition when WiFi functional tests pass. Alternatively, install the wireless-regdb package in the test rootfs to provide the regulatory.db file and eliminate the warning.
  4. Detail analysis attachment: failed_case_job212443_1_detailed.md
  Case 2: smmu (Test Logic False Positive)
  1. Failed case: smmu (Test Logic False Positive)
  2. Root cause: The smmu test incorrectly expects video-decoder and video-encoder to be separate platform devices with individual IOMMU group attachments. On qcs615-ride, the Venus video codec driver uses a single parent device (aa00000.video-codec) that is correctly attached to IOMMU group 7, with video-decoder and video-encoder as child nodes within the driver, not separate platform devices requiring their own IOMMU groups.
  3. Possible fix: Update the smmu test logic to recognize that Venus video codec child nodes (video-decoder/video-encoder) do not require separate IOMMU group attachments when the parent video-codec device is correctly protected. The test should pass when aa00000.video-codec is attached to an IOMMU group, regardless of child node attachment status.
  4. Detail analysis attachment: failed_case_job212443_2_detailed.md
  Case 3: KVM Driver Initialization Failure
  1. Failed case: KVM Driver Initialization Failure
  2. Root cause: KVM driver cannot initialize on QCS615-ride because the Gunyah hypervisor is running at EL2 and does not expose nested virtualization support. KVM requires direct EL2 access to create VMs, but the kernel is running as a Gunyah guest at EL1 without virtual EL2 capability.
  3. Possible fix: This is an expected platform limitation, not a PR-introduced regression. To resolve: (1) Disable CONFIG_KVM in the kernel config for QCS615 builds running under Gunyah, or (2) Add KVM test skip logic for platforms with active hypervisors, or (3) Enable nested virtualization support in Gunyah firmware (requires hypervisor changes, not kernel changes).
  4. Detail analysis attachment: failed_case_job212443_3_detailed.md
  Case 4: ** KVM Initialization Failure — HYP mode not available
  1. Failed case: ** KVM Initialization Failure — HYP mode not available
  2. Root cause: ** KVM driver initialization failed on qcs615-ride because the Gunyah hypervisor is already running at EL2 (Hypervisor mode), preventing KVM from acquiring the required exclusive access to EL2. This is a platform architecture constraint where only one hypervisor can control EL2 at a time.
  3. Possible fix: Mark KVM tests as SKIP (not FAIL) on qcs615-ride and other Gunyah-enabled platforms. Update the test runner to detect Gunyah presence via dmesg | grep "Hypervisor cold boot" and skip KVM tests with reason "Platform runs Gunyah hypervisor — KVM unavailable". Alternatively, create a qcs615-ride-specific test configuration that excludes KVM tests entirely.
  4. Detail analysis attachment: failed_case_job212443_4_detailed.md
  Case 5: KVM Infrastructure Unavailable — Platform Configuration Issue
  1. Failed case: KVM Infrastructure Unavailable — Platform Configuration Issue
  2. Root cause: QCS615-ride platform runs Gunyah hypervisor in protected mode which reserves EL2 (Hypervisor Exception Level) exclusively for Gunyah, preventing Linux KVM from initializing. Kernel message at boot: kvm [1]: HYP mode not available. This is expected behavior on Gunyah-based platforms and not a kernel regression.
  3. Possible fix: Disable KVM-dependent tests (KVM_Driver, KVM_EL2_DTB, KVM_Infra) in the LAVA test suite for qcs615-ride and other Gunyah-based platforms, or mark them as expected failures with a skip condition checking for Gunyah hypervisor presence. KVM cannot function on platforms where a Type-1 hypervisor (Gunyah) has taken exclusive control of EL2.
  4. Detail analysis attachment: failed_case_job212443_5_detailed.md
  Case 6: KVM_Infra
  1. Failed case: KVM_Infra
  2. Root cause: KVM initialization failed because the QCS615 Ride board is running under the Gunyah hypervisor (version gunyah-cdfb73831), which operates at EL2 and does not expose HYP mode to Linux. The kernel message "kvm [1]: HYP mode not available" confirms Linux cannot access EL2, preventing KVM driver initialization and /dev/kvm creation.
  3. Possible fix: This is expected behavior for the current platform configuration and not a PR-introduced regression. To enable KVM testing: (1) reconfigure the board firmware to boot Linux directly at EL2 without Gunyah, or (2) use nested virtualization if Gunyah supports it, or (3) skip KVM tests on boards running under Gunyah by adding a platform-specific test filter in the LAVA job definition.
  4. Detail analysis attachment: failed_case_job212443_6_detailed.md
Job 212444 | SoC shikra-iqs-evk

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212444

Failed test cases in LAVA job 212444 (SoC: shikra-iqs-evk).

  Case 1: GIC
  1. Failed case: GIC
  2. Root cause: Test script bug at line 75 of run.sh — script hardcodes assumption of 8 CPUs and attempts to parse interrupt counts for CPUs 4-7 from /proc/interrupts, but shikra-iqs-evk has only 4 CPUs (0-3), causing bash integer comparison to fail with "GICv3: integer expected" when it extracts non-numeric column values (device name strings) instead of interrupt counts.
  3. Possible fix: Update the GIC test script to dynamically detect the number of online CPUs from /sys/devices/system/cpu/online or /proc/cpuinfo instead of hardcoding an 8-CPU assumption, then iterate only over the actual CPU count when parsing /proc/interrupts columns.
  4. Detail analysis attachment: failed_case_job212444_1_detailed.md
  Case 2: Probe_Failure_Check
  1. Failed case: Probe_Failure_Check
  2. Root cause: The Probe_Failure_Check test detected multiple probe failures on shikra-iqs-evk, including coresight-etm4x (error -22/EINVAL) for all four ETM instances, cpufreq-dt (error -17/EEXIST), regulatory.db firmware load failure (error -2/ENOENT), and persistent deferred probes for sound/audio codec/WiFi devices. The coresight-etm4x failures are pre-existing platform/DT issues unrelated to the PR (which only refactors PM save/restore logic without changing probe error paths); the cpufreq-dt -EEXIST is a known benign duplicate registration; the regulatory.db firmware absence is expected in minimal rootfs; and the deferred probes indicate missing DT resources (clocks, regulators, DAI links) that are board-specific configuration gaps, not PR-introduced regressions.
  3. Possible fix: Mark this test case as expected-fail or suppress known benign probe failures (coresight-etm4x -EINVAL on shikra due to missing DT cpu property, cpufreq-dt -EEXIST duplicate, regulatory.db -ENOENT in minimal rootfs) in the Probe_Failure_Check test logic. For the coresight-etm4x issue specifically: add the missing "cpu" property to the ETM DT nodes in arch/arm64/boot/dts/qcom/shikra*.dtsi, following the pattern used in other Qualcomm SoC device trees (e.g., sc8280xp.dtsi shows cpu = <&CPU0>; for etm@7040000).
  4. Detail analysis attachment: failed_case_job212444_2_detailed.md
  Case 3: USBHost
  1. Failed case: USBHost
  2. Root cause: USB host controller driver (dwc3/xhci) did not probe on the shikra-iqs-evk platform. The USB device node at 4e00000.usb is present in device tree and added to IOMMU group 5, but no USB host controller driver initialization messages appear in the kernel log. USB core subsystem registered successfully (usbcore, usbfs, hub, usb-storage, usbhid), but without a functioning host controller driver, no USB devices can be enumerated. This is not a PR-introduced regression but rather a pre-existing platform configuration or driver availability issue specific to the shikra-iqs-evk board.
  3. Possible fix: Verify that the USB host controller driver (CONFIG_USB_DWC3, CONFIG_USB_DWC3_QCOM, CONFIG_USB_XHCI_HCD) is enabled in the kernel configuration and built as a module or built-in. Check the device tree for the shikra-iqs-evk board to ensure the USB node at 4e00000.usb has the correct compatible string and all required properties (clocks, resets, PHY phandles, power domains). If the driver is present but not probing, enable dynamic debug for the dwc3 and xhci drivers (echo 'module dwc3 +p' > /sys/kernel/debug/dynamic_debug/control) and check dmesg for deferred probe or missing dependency messages.
  4. Detail analysis attachment: failed_case_job212444_3_detailed.md
  Case 4: ** KVM_Driver — Driver Initialization Failure
  1. Failed case: ** KVM_Driver — Driver Initialization Failure
  2. Root cause: ** KVM driver initialization failed at boot because the platform (Shikra IQS EVK) does not support ARM Hypervisor mode (EL2). The kernel message kvm [1]: HYP mode not available at boot time (3.291957s) indicates the CPU is not running at EL2 or EL2 is disabled by firmware/bootloader, preventing KVM from creating the /dev/kvm device node. This is a platform/firmware limitation, not a kernel regression.
  3. Possible fix: This is NOT a PR-introduced regression. The Shikra IQS EVK platform does not support KVM virtualization because EL2 (hypervisor mode) is not available. The test should be marked as SKIP (not FAIL) for this platform, or the platform firmware should be updated to enable EL2 if the hardware supports it. To fix the test: update the test suite to detect HYP mode not available in dmesg and report SKIP instead of FAIL for platforms without EL2 support.
  4. Detail analysis attachment: failed_case_job212444_4_detailed.md
  Case 5: ** Kernel Crash — Synchronous External Abort in qcom_rng driver (KVM_EL2_DTB is a secondary victim)
  1. Failed case: ** Kernel Crash — Synchronous External Abort in qcom_rng driver (KVM_EL2_DTB is a secondary victim)
  2. Root cause: ** The qcom_hwrng test triggered a synchronous external abort (hardware bus error) at qcom_rng_read+0xc4 when attempting to read from the Qualcomm hardware RNG MMIO registers on shikra-iqs-evk, causing a kernel panic and system reboot; KVM_EL2_DTB subsequently failed because it ran after the reboot and /dev/kvm was not available in the post-crash state.
  3. Possible fix: Investigate and fix the qcom_rng hardware access issue on shikra-iqs-evk: verify RNG hardware clock/power-domain/regulator dependencies in the device tree, ensure the RNG hardware block is properly initialized by firmware, and add proper error handling in the qcom_rng driver to gracefully handle hardware access failures instead of crashing the kernel; as a short-term mitigation, skip the qcom_hwrng test on shikra-iqs-evk until the hardware access issue is resolved.
  4. Detail analysis attachment: failed_case_job212444_5_detailed.md
  Case 6: ** Kernel Crash — qcom_rng synchronous external abort (KVM_Infra test failure is non-fatal pre-existing issue)
  1. Failed case: ** Kernel Crash — qcom_rng synchronous external abort (KVM_Infra test failure is non-fatal pre-existing issue)
  2. Root cause: ** The KVM_Infra test failure (/dev/kvm is not available) is a pre-existing infrastructure/configuration issue unrelated to PR Merge tag 'v6.18.44' into qcom-6.18.y #970 — CONFIG_KVM is enabled but the KVM device node was never created, indicating KVM initialization failed silently. However, the actual fatal issue is a kernel crash in the qcom_rng driver that occurred immediately after the KVM_Infra test. The crash is a synchronous external abort (hardware bus error ESR 0x96000010) at PC qcom_rng_read+0xc4/0x228 when the qcom_hwrng test attempted to read entropy from /dev/hwrng. The faulting instruction attempted to read hardware register at MMIO offset 0x35c, but the qcom_rng hardware block did not respond, indicating it is unpowered, not clocked, held in reset, or its MMIO region is not correctly mapped on Shikra IQS EVK.
  3. Possible fix: Immediate mitigation: disable the qcom_hwrng test on Shikra IQS EVK or blacklist the qcom_rng module. Proper fix: verify the qcom_rng device tree node for Shikra IQS EVK includes correct clock, regulator, and reset bindings; ensure the RNG hardware block is powered and clocked before driver probe; add runtime PM support if missing. If the hardware block is not present or not functional on this platform, remove the DT node or set status = "disabled". The KVM_Infra test failure should be investigated separately as a pre-existing infrastructure issue.
  4. Detail analysis attachment: failed_case_job212444_6_detailed.md
  Case 7: ** Kernel Crash — Synchronous External Abort in qcom_rng driver
  1. Failed case: ** Kernel Crash — Synchronous External Abort in qcom_rng driver
  2. Root cause: ** The qcom_rng driver triggered a synchronous external abort (bus error) at PC qcom_rng_read+0xc4 when attempting to read from a hardware register at offset 0x0c (instruction b940035c = ldr w28, [x26, #0xc]). This indicates the RNG hardware block is either not clocked/powered, not mapped correctly, or the hardware is in an unexpected state on the shikra-iqs-evk platform.
  3. Possible fix: Verify the qcom_rng device tree node for shikra (sm8750) includes correct register base address, clock references, and power domain bindings. Check if the RNG hardware block requires explicit clock/power enablement before register access. Add runtime PM or clock enable calls in the qcom_rng driver probe path if missing. If the hardware is not present or functional on shikra-iqs-evk, mark the DT node as status = "disabled" for this board variant.
  4. Detail analysis attachment: failed_case_job212444_7_detailed.md
  Case 8: ** Kernel Crash — synchronous external abort in qcom_rng driver
  1. Failed case: ** Kernel Crash — synchronous external abort in qcom_rng driver
  2. Root cause: ** Hardware access fault (synchronous external abort) in qcom_rng_read() at offset +0xc4 while reading from the Qualcomm hardware RNG device during the qcom_hwrng test. The fault occurred when dereferencing a hardware register address (x19: 0x000000b9dc505f3a), triggering a paging request failure in EFI runtime service context, followed by kernel panic. This is a pre-existing platform/firmware issue unrelated to the PR (PR touches I3C, cpufreq docs, ARM64 CPU hotplug docs, crypto userspace API, and RNG core exit handler — none of which affect qcom_rng hardware access paths on shikra-iqs-evk).
  3. Possible fix: This is a known shikra-iqs-evk platform issue with EFI runtime services and hardware RNG access. Workaround: Add efi=noruntime to kernel command line to disable EFI runtime services, or disable the qcom_hwrng test in the CI test suite for this platform until the firmware/hardware issue is resolved. The PR is not the cause and should not be blocked by this failure.
  4. Detail analysis attachment: failed_case_job212444_8_detailed.md
  Case 9: Kernel Crash — synchronous external abort in qcom_rng driver
  1. Failed case: Kernel Crash — synchronous external abort in qcom_rng driver
  2. Root cause: The qcom_hwrng test triggered a synchronous external abort (hardware fault) at PC qcom_rng_read+0xc4 when reading from the hardware RNG device. The fault occurred during a memory access (b940035c instruction) to the RNG hardware registers, indicating the RNG hardware block is either not powered, not clocked, or the MMIO mapping is invalid on the shikra-iqs-evk platform.
  3. Possible fix: Verify the qcom_rng device tree node for shikra-iqs-evk includes correct reg address, clocks, and power-domain properties. If the RNG hardware is not functional on this SoC variant, mark the DT node as status = "disabled" or add a runtime probe-time check in the qcom_rng driver to gracefully skip initialization when the hardware is not accessible.
  4. Detail analysis attachment: failed_case_job212444_9_detailed.md
  Case 10: Kernel Crash — Synchronous External Abort in qcom_rng driver
  1. Failed case: Kernel Crash — Synchronous External Abort in qcom_rng driver
  2. Root cause: Hardware access fault (synchronous external abort 0x96000010) in qcom_rng_read() at PC offset +0xc4 when reading from MMIO register during qcom_hwrng test execution; the qcom_rng driver attempted to read from an unmapped, powered-off, or inaccessible hardware RNG register, triggering a bus-level external abort that escalated to kernel panic.
  3. Possible fix: Verify qcom_rng device power state and clock enablement before MMIO access; add runtime PM calls or clock gating checks in qcom_rng probe/read paths; if the hardware block is not present or not functional on shikra-iqs-evk, disable the qcom_rng driver in the device tree or kernel config for this platform; alternatively, add proper error handling for external aborts in the RNG read path to prevent system-wide panic.
  4. Detail analysis attachment: failed_case_job212444_10_detailed.md
Job 212445 | SoC lemans-evk

LAVA job: https://lava-oss.qualcomm.com/scheduler/job/212445

Failed test cases in LAVA job 212445 (SoC: lemans-evk).

  Case 1: Probe_Failure_Check
  1. Failed case: Probe_Failure_Check
  2. Root cause: Four PMIC temp-alarm devices (c440000.spmi:pmic@{0,2,4,6}:temp-alarm@a00) remain in permanent deferred probe state on lemans-evk, indicating the qcom_spmi_temp_alarm driver loaded but failed to bind due to missing or unready dependencies (likely thermal zone or IIO channel dependencies not resolved).
  3. Possible fix: Investigate why the qcom_spmi_temp_alarm driver (module is loaded) cannot complete probe for these four PMIC thermal devices — check device tree for correct thermal-zone linkage, IIO ADC channel availability, and SPMI PMIC sub-device registration order; if DT is correct, enable CONFIG_DEBUG_DRIVER and add dynamic debug for drivers/thermal/qcom/qcom-spmi-temp-alarm.c to capture the exact -EPROBE_DEFER reason, then fix the missing dependency provider or adjust probe ordering.
  4. Detail analysis attachment: failed_case_job212445_1_detailed.md
  Case 2: smmu
  1. Failed case: smmu
  2. Root cause: The video codec device (aa00000.video-codec) is not attached to any IOMMU group, causing the SMMU test's critical master validation to fail. The device exists in the device tree but the driver either did not probe successfully or the device is not configured with IOMMU bindings in the device tree for the lemans-evk platform.
  3. Possible fix: Verify the device tree for lemans-evk includes proper iommus property for the video-codec node at aa00000. If missing, add the IOMMU binding to the device tree. If present, investigate why the video codec driver (qcom_iris module is loaded) did not attach the device to an IOMMU group during probe.
  4. Detail analysis attachment: failed_case_job212445_2_detailed.md
  Case 3: 0_qcom-next-ci-premerge-tests
  1. Failed case: 0_qcom-next-ci-premerge-tests
  2. Root cause: LAVA test definition marked as failed due to two individual test case failures within the test suite: (1) Probe_Failure_Check failed due to deferred probe issues with PMIC temp-alarm devices and missing firmware files (regulatory.db, Bluetooth firmware), and (2) smmu test failed because the video codec device (aa00000.video-codec) is missing iommu_group attachment on lemans-evk. The test runner completed successfully, but LAVA's standard behavior is to mark the overall test definition as failed when any constituent test case fails.
  3. Possible fix: These are pre-existing platform/configuration issues unrelated to the PR content (which contains documentation updates, DT binding fixes, and driver changes not affecting lemans-evk PMIC thermal or video codec IOMMU configuration). For Probe_Failure_Check: investigate why PMIC temp-alarm devices remain in deferred probe state and ensure required firmware files are present in the rootfs. For smmu: verify the video codec DT node includes proper iommu property and that the IOMMU driver is loaded before the video codec driver probes. Re-run the CI job after fixing these platform-specific issues.
  4. Detail analysis attachment: failed_case_job212445_3_detailed.md

@qlijarvis

Copy link
Copy Markdown

PR #970 — validate-patch

PR: #970

Verdict Issues Detailed Report
0 Full report

Final Summary

  1. Lore link present: No — no lore.kernel.org link found in pr.patch
  2. Lore link matches PR commits: N/A — no lore link to compare against
  3. Upstream patch status: N/A — no upstream patch to check (appears to be a merge/integration commit)
  4. PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence
Verdict: ❌ — click to expand

🔍 Patch Validation

PR: #970 (qualcomm-linux/kernel)
Upstream commit: N/A
Verdict: ❌ FAIL

Commit Message

Check Status Note
Subject matches upstream No commit message found in patch
Body preserves rationale No commit message found in patch
Fixes tag present/correct N/A Not applicable
Authorship preserved No author information in patch
Backport note (if applicable) N/A Not applicable

Diff

File Status Notes
94,677 files changed Massive merge/integration commit with no commit metadata

Issues

Critical validation failures:

  1. No lore.kernel.org link found — The PR patch contains no Link: tag pointing to lore.kernel.org. According to the validate-patch skill, this is an immediate FAIL condition.

  2. No commit metadata — The pr.patch file is a plain unified diff with no git commit message, author, date, or any metadata. This makes it impossible to validate:

    • Commit subject/prefix correctness
    • Authorship preservation
    • Signed-off-by chain
    • Commit message rationale
  3. Massive scope — The patch modifies 94,677 files across the entire kernel tree, including:

    • Core Makefile (version bump)
    • Documentation across all subsystems
    • MAINTAINERS file
    • Drivers for all architectures (arm, arm64, alpha, etc.)
    • Device tree files for multiple vendors
    • Configuration files

    This appears to be a mainline merge or rebase commit, not a targeted patch suitable for lore-based validation.

  4. Integration presence: PARTIAL — According to integration_presence_report.md, the commit has only partial tree presence in qcom-next and topics:

    • 1,118,832 added lines checked
    • 41,943 lines missing from qcom-next
    • 41,877 lines missing from topics/baseline
    • Missing samples include core files like Makefile, MAINTAINERS, and various subsystem files

Verdict

Do not merge. This PR cannot be validated using the validate-patch skill for the following reasons:

  1. No lore link — The validate-patch skill explicitly requires a lore.kernel.org link in the PR description or commit message. Without this, there is no upstream source to compare against.

  2. Wrong validation tool — A 94,677-file merge commit is not a patch that should be validated against lore.kernel.org. This type of integration commit requires different validation:

    • If this is a mainline merge: verify the merge base and conflict resolution
    • If this is an automerge/integration: use the integrate-qli or automerge skill
    • If this is a rebase: verify the rebase was clean and no unintended changes were introduced
  3. Incomplete integration — The commit is only partially present in qcom-next/topics, with ~42K lines missing. This suggests the integration is incomplete or the PR contains changes not yet in the integration branches.

Recommended action:

  • If this is a mainline merge: Add a proper commit message with Merge tag 'v6.X' into <branch> format
  • If this is an integration commit: Use the appropriate integration workflow and validation tools
  • If this is a mistake: Close the PR and create properly formatted, atomic commits with lore links for each logical change

Final Summary

  1. Lore link present: No — no lore.kernel.org link found in pr.patch
  2. Lore link matches PR commits: N/A — no lore link to compare against
  3. Upstream patch status: N/A — no upstream patch to check (appears to be a merge/integration commit)
  4. PR present in qcom-next/topics: Partial — 1/1 commit has only partial integration evidence (41,943 lines missing from qcom-next, 41,877 lines missing from topics/baseline)

Deterministic Integration Presence

Integration Presence Report

This report is generated by Jarvis before validate-patch runs.
It is the authoritative source for whether PR changes are already present
in qcom-next or in the kernel topic branches.

Kernel repo: /local/mnt/workspace/sgaud/Qgenie/image_pipeline/kernel
qcom-next ref: d49c33864d06e9672dce57738be8851384578fcf
topics remote: topics -> https://github.com/qualcomm-linux/kernel-topics
topics fetch: fetched

Commit Subject qcom-next topics Final
1/1 `` partial - subject or partial tree evidence found, but full change was not verified partial - subject or partial tree evidence found, but full change was not verified partial

Final Status

overall_status: PARTIAL
present_commits: 0/1
partial_commits: 1/1
missing_commits: 0/1
topics_checked_for_commits: 1/1
final_summary: PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence

@qlijarvis

Copy link
Copy Markdown

PR #970 — checker-log-analyzer

PR: #970
Checker run: https://github.com/qualcomm-linux/kernel-config/actions/runs/32819697883

Checker Result Summary
Checker Result Summary
checkpatch Multiple "Unknown commit id" warnings (expected for stable backports)
dt-binding-check All binding checks passed
dtb-check New errors: Allwinner A523 pinctrl interrupts array too long; Nvidia Tegra234 MGBE missing 'ptp-ref' clock-name
sparse-check Passed
check-uapi-headers Multiple "fatal: path exists on disk, but not in base" errors (new files added in stable update)
check-patch-compliance 3297 commits missing required subject prefix
tag-check BLOCKER: All 3297 commits lack required prefix tags

Detailed report: Full report

Checker analysis — click to expand

🤖 CI Checker Analysis (checker-log-analyzer)

PR: #970 (Linux 6.18.44 stable update)
Target branch: qcom-6.18.y
Source: https://github.com/qualcomm-linux/kernel-config/actions/runs/32819697883

Checker Result Summary
checkpatch Multiple "Unknown commit id" warnings (expected for stable backports)
dt-binding-check All binding checks passed
dtb-check New errors: Allwinner A523 pinctrl interrupts array too long; Nvidia Tegra234 MGBE missing 'ptp-ref' clock-name
sparse-check Passed
check-uapi-headers Multiple "fatal: path exists on disk, but not in base" errors (new files added in stable update)
check-patch-compliance 3297 commits missing required subject prefix
tag-check BLOCKER: All 3297 commits lack required prefix tags

❌ check-patch-compliance — Missing Subject Prefix (BLOCKER)

Root cause: All 3297 commits in this PR lack the required subject-line prefix tag.

Failure details:

Checking commit: KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit summary does not start with a required prefix

Checking commit: lsm: add backing_file LSM hooks
Commit summary does not start with a required prefix

Checking commit: selinux: fix overlayfs mmap() and mprotect() access checks
Commit summary does not start with a required prefix

... (3297 total commits)

Why this is failing:
The target branch is qcom-6.18.y, which is not qcom-next or qcom-next-staging. Per the kernel-checkers policy, every commit merged into branches other than qcom-next/qcom-next-staging must start its subject line with one of the following prefix tags:

  • UPSTREAM: — Patch merged into Linus's mainline tree
  • FROMLIST: — Patch posted to mailing list (lore.kernel.org)
  • FROMGIT: — Patch taken from a maintainer git tree
  • BACKPORT: — Upstream patch backported with modifications
  • QCLINUX: — Vendor-only change with no upstream equivalent
  • PENDING: — Work-in-progress, not yet posted upstream
  • WORKAROUND: — Temporary fix not suitable for upstream

Context:
This PR appears to be a Linux 6.18.44 stable kernel update (based on the final commit "Linux 6.18.44" and the large number of commits). All commits in a stable kernel release are upstream patches, so they should be prefixed with UPSTREAM:.

Fix:
Rebase the entire PR and prepend UPSTREAM: to every commit subject:

# Interactive rebase to edit all commits
git rebase -i <base_sha>

# For each commit, amend the subject:
git commit --amend -m "UPSTREAM: <original subject>"
git rebase --continue

Alternative (automated):
Use a script to rewrite all commit messages in bulk:

git filter-branch -f --msg-filter '
  if ! echo "$GIT_COMMIT_MSG" | grep -qE "^(UPSTREAM|FROMLIST|FROMGIT|BACKPORT|QCLINUX|PENDING|WORKAROUND):"; then
    echo "UPSTREAM: $GIT_COMMIT_MSG"
  else
    cat
  fi
' <base_sha>..HEAD

Reproduce locally:

git log <base_sha>..HEAD --format="%H %s" | while read sha subject; do
  if ! echo "$subject" | grep -qE '^(UPSTREAM|FROMLIST|FROMGIT|BACKPORT|QCLINUX|PENDING|WORKAROUND):'; then
    echo "MISSING prefix: $sha $subject"
  fi
done

❌ dtb-check — New DTB Validation Errors

Root cause: Two new devicetree validation errors introduced by this PR.

Failure details:

Error 1: Allwinner A523 pinctrl interrupts array too long

/opt/actions-runner/_work/kernel-config/kernel-config/kernel/temp-out/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dtb: 
  pinctrl@2000000 (allwinner,sun55i-a523-pinctrl): 
  interrupts: [[0, 67, 4], [0, 69, 4], [0, 71, 4], [0, 73, 4], [0, 75, 4], [0, 77, 4], [0, 79, 4], [0, 81, 4], [0, 83, 4], [0, 85, 4], [0, 140, 4]] is too long
  from schema $id: http://devicetree.org/schemas/pinctrl/allwinner,sun55i-a523-pinctrl.yaml

The allwinner,sun55i-a523-pinctrl binding schema limits the number of interrupt entries, but the DTS provides 11 interrupts. This is likely a binding schema issue where maxItems is set too low.

Error 2: Nvidia Tegra234 MGBE missing 'ptp-ref' clock-name

Multiple Tegra234 DTBs: ethernet@6800000 (nvidia,tegra234-mgbe): clock-names:3: 'ptp-ref' was expected

The nvidia,tegra234-mgbe binding expects a ptp-ref clock at index 3, but the DTS files do not provide it.

Fix:

For Error 1 (Allwinner A523):
Update the binding schema Documentation/devicetree/bindings/pinctrl/allwinner,sun55i-a523-pinctrl.yaml to allow up to 11 interrupt entries:

interrupts:
  maxItems: 11  # or remove maxItems if variable

For Error 2 (Nvidia Tegra234):
Add the missing ptp-ref clock to all affected Tegra234 DTS files:

clocks = <&bpmp TEGRA234_CLK_MGBE0_APP>,
         <&bpmp TEGRA234_CLK_MGBE0_MAC>,
         <&bpmp TEGRA234_CLK_MGBE0_MAC_DIVIDER>,
         <&bpmp TEGRA234_CLK_MGBE0_PTP_REF>;  // Add this
clock-names = "rx", "tx", "mac", "ptp-ref";  // Add "ptp-ref"

Reproduce locally:

make -j$(nproc) O=out defconfig
make -j$(nproc) O=out CHECK_DTBS=y arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dtb
make -j$(nproc) O=out CHECK_DTBS=y arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dtb

❌ check-uapi-headers — New Files Not in Base

Root cause: Multiple new files added in this stable update that do not exist in the base commit.

Failure details:

fatal: path 'drivers/gpu/Kconfig' exists on disk, but not in 'dc0f4d4280a7ecfcf8bc2d6bff1f42b1b8d33b08'
fatal: path 'drivers/gpu/buddy.c' exists on disk, but not in 'dc0f4d4280a7ecfcf8bc2d6bff1f42b1b8d33b08'
fatal: path 'drivers/gpu/drm/xe/xe_pagefault.c' exists on disk, but not in 'dc0f4d4280a7ecfcf8bc2d6bff1f42b1b8d33b08'
... (multiple files)

Analysis:
This is expected behavior for a stable kernel update that introduces new files. The check-uapi-headers checker compares the current tree against the base commit and flags new files. Since this is a 6.18.44 stable update, new files are legitimate additions from upstream.

Verdict: This is not a blocker — it's expected for stable updates. The checker is correctly identifying new files; no action needed.


⚠️ checkpatch — Unknown Commit ID Warnings

Root cause: Checkpatch reports "Unknown commit id" warnings for commits referenced in commit messages.

Failure details:

WARNING: Unknown commit id 'fb0bf289f5d529336ef490c8273e88a8a8b29f69', maybe rebased or not pulled?
WARNING: Unknown commit id '7aa7d4bf9d3f', maybe rebased or not pulled?
WARNING: Duplicate signature

Analysis:
These warnings occur because:

  1. The referenced commits exist in upstream Linux but not in the current tree's history (expected for stable backports).
  2. Some commits have duplicate Signed-off-by: trailers (e.g., Greg Kroah-Hartman signing both as author and stable maintainer).

Verdict: These are informational warnings, not blockers. Stable kernel updates routinely reference upstream commits that aren't in the tree's direct history. The duplicate signature warnings are also acceptable for stable releases where the maintainer adds their sign-off.


Verdict

BLOCKER: Cannot merge until all 3297 commits are prefixed with UPSTREAM:

The PR contains a Linux 6.18.44 stable kernel update with 3297 commits, all of which lack the required subject-line prefix tag. Since the target branch is qcom-6.18.y (not qcom-next or qcom-next-staging), every commit must start with a valid prefix.

Required action:
Rebase the entire PR and prepend UPSTREAM: to every commit subject line.

Secondary issues (non-blocking but should be addressed):

  • dtb-check: Fix Allwinner A523 pinctrl binding schema and add missing Tegra234 MGBE ptp-ref clocks.
  • check-uapi-headers: New files are expected for stable updates; no action needed.
  • checkpatch: "Unknown commit id" warnings are expected for stable backports; no action needed.

@sgaud-quic
Salendarsingh Gaud (sgaud-quic) merged commit 1da8efc into qualcomm-linux:qcom-6.18.y Sep 7, 2026
4 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.