Daily update · Aug 5–6, 2026
Device tree fixes across Qualcomm, Broadcom, and Aspeed land alongside core mm and security fixes
A busy day of hardware description corrections: ESPI interrupt mappings on Qualcomm Glymur, a Raspberry Pi 5 boot hang, an Aspeed LPC snoop kernel memory exposure, and a TLB flush address bug in page table reclaim.
In brief
Today's mainline pull is dominated by arm64 and ARM device tree fixes, with Qualcomm platforms receiving the bulk of attention: Glymur gets corrected ESPI interrupt mappings for PCIe SMMU and QUP serial engines, Purwa's GPU IOMMU SID is fixed, and several sc8280xp and sm8650 boards see interrupt map and IPA IMEM corrections. Two notable non-DT fixes stand out: an Aspeed LPC snoop driver usercopy overflow that could leak kernel memory, and a core mm fix where page table reclaim flushed the wrong TLB address.
Security and core kernel fixes
Aspeed LPC snoop: fix usercopy overflow exposing kernel memory
The LPC snoop driver's IRQ handler and read path both access a kfifo without synchronization; on SMP the in/out indices can diverge beyond the buffer size, causing copy_to_user() to read past the kmalloc-2k backing store and trigger a kernel memory exposure abort.
Why it matters: Fixes a kernel memory disclosure path on multi-core Aspeed BMC systems using the LPC snoop interface.
mm: correct TLB flush address in direct page table reclaim
zap_pte_range passed addr to pte_free_tlb even though addr always points one past the end of the table's range, meaning architectures that use the flush parameter would invalidate the wrong paging-structure-cache entry.
Why it matters: Correctness fix for architectures relying on the TLB flush address; existing systems mostly worked by accident due to surrounding flush behavior.
Broadcom fixes
Raspberry Pi 5: remove non-functional EL2 virtual timer
A prior arch_timer change defaulted to the EL2 virtual timer under VHE, but Broadcom confirmed the interrupt line was never connected on bcm2712, causing boot to hang. The corresponding DT node is removed.
Why it matters: Fixes boot hangs on Raspberry Pi 5 introduced by the arm_arch_timer default change.
BCM5301X: fix PCIe controller 2 interrupt and EA9200 NVRAM size
A copy-paste error mapped PCIe controller 2 interrupt 1 to GIC SPI 138 instead of 139; separately, the Linksys EA9200 NVRAM size was oversized, triggering a driver warning.
Why it matters: Corrects interrupt routing on BCM5301X routers and silences an NVRAM size warning on EA9200.
Qualcomm device tree fixes
Glymur: correct ESPI interrupt mappings for PCIe SMMU and QUP serial engines
Glymur's PCIe SMMUv3 wired interrupts and QUP wrapper 0 serial-engine interrupts are routed to GIC extended SPI INTIDs but were described as regular SPIs, producing incorrect interrupt specifiers. Both commits correct them to ESPI-relative numbers.
Why it matters: Fixes interrupt descriptions on the Qualcomm Glymur platform since its initial introduction.
Purwa: remove unsupported GPU SID 1 from IOMMU property
Purwa's GPU does not support SID 1, used for LPAC traffic; including it caused a synchronous external abort in arm_smmu_write_s2cr under some Gunyah hypervisor versions.
Why it matters: Fixes a crash during GPU probe on Purwa IoT EVK with affected Gunyah versions.
sc8280xp: add missing PDC entries and fix gaokun3 EC interrupt pin
PDC mappings for interrupts 215, 256, and 257 were missing; on the Huawei gaokun3, the EC interrupt GPIO was incorrectly set to 107 instead of 103, causing a permanent interrupt storm and continuous event polling.
Why it matters: Fixes missing wake-capable interrupt routing on sc8280xp and stops an interrupt storm on the gaokun3 laptop.
Lenovo Yoga C630: lower PSCI cluster idle depth for stability
The default PSCI cluster idle suspend value caused instability, including resets when the display device was not probed early. Dropping bit 0x4000 yields a shallower sleep state but a stable system.
Why it matters: Improves stability on the Lenovo Yoga C630 at the cost of slightly higher suspend power use.
sm8650 IPA IMEM slice, eliza DSI1 phy clock, and monaco GIC address-cells
sm8650's IPA IMEM slice is corrected to match downstream; eliza's DSI1 PHY reference clock was copy-pasted with the wrong parent, which would produce incorrect PLL frequencies; monaco gets a missing #address-cells on its GIC node to silence a W=1 warning.
Why it matters: Fixes IPA modem tables on SM8650, corrects DSI1 PHY clocking on eliza, and clears a device tree warning on monaco.
Other platform and maintainer updates
ARM npcm: fix OF node refcount leaks in SMP setup
npcm7xx SMP setup looked up GCR and SCU nodes via of_find_compatible_node() without dropping the references, leaking device node refcounts on Nuvoton BMCs.
Why it matters: Fixes a long-standing refcount leak on Nuvoton NPCM BMC platforms.
MAINTAINERS: merge NXP Layerscape into i.MX; add Aspeed reviewers
The standalone Layerscape maintainer entry lacked the imx mailing list, causing patches to miss NXP's Patchwork; it is consolidated with i.MX. Ryan Chen and Billy Tsai are added as Aspeed reviewers.
Why it matters: Improves patch routing for NXP platforms and documents Aspeed review coverage.
Source commits17 entries +
arm64: dts: qcom: monaco: Add default GIC address cells
Krzysztof Kozlowski · Apr 7, 2026 · 1 files
arm64: dts: qcom: purwa: Fix GPU IOMMU property
Akhil P Oommen · Apr 9, 2026 · 1 files
arm64: dts: qcom: sm8650: Fix IPA IMEM slice
Alexander Koskovich · Apr 15, 2026 · 1 files
arm64: dts: qcom: sc8280xp: add several missing pdc map entries
Pengyu Luo · Apr 19, 2026 · 1 files
arm64: dts: qcom: sc8280xp: gaokun3: correct EC interrupt pin
Pengyu Luo · Apr 19, 2026 · 1 files
arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
Dmitry Baryshkov · Apr 28, 2026 · 1 files
ARM: npcm: Fix OF node refcount leaks in SMP setup
Yuho Choi · May 25, 2026 · 1 files
arm64: dts: qcom: glymur: fix QUP serial engine IRQs
Bjorn Andersson · Jun 11, 2026 · 1 files
arm64: dts: qcom: glymur: fix PCIe SMMU interrupts
Bjorn Andersson · Jun 11, 2026 · 1 files
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
Karthikeyan KS · Jun 12, 2026 · 2 files
ARM: dts: BCM5301X: EA9200: fix NVRAM size
Rosen Penev · Jun 28, 2026 · 1 files
MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entry
Frank Li · Jun 30, 2026 · 1 files
arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rate
Krzysztof Kozlowski · Jul 13, 2026 · 1 files
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Daniel Drake · Jul 16, 2026 · 1 files
MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED
Billy Tsai · Jul 23, 2026 · 1 files
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
Rosen Penev · Jul 25, 2026 · 1 files
mm: fix incorrect flush address in direct page table reclaim
Andy Lutomirski · Aug 4, 2026 · 1 files