<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/include/linux/firmware, branch linux-rolling-stable</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>remoteproc: xlnx: Check remote core state</title>
<updated>2026-07-24T14:20:57+00:00</updated>
<author>
<name>Tanmay Shah</name>
<email>tanmay.shah@amd.com</email>
</author>
<published>2026-04-28T22:18:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f80fafe24f7221bfd1108b752108c1fcc6528fca'/>
<id>f80fafe24f7221bfd1108b752108c1fcc6528fca</id>
<content type='text'>
commit a48df51d23138388900995add2854cda4aa68e55 upstream.

The remote state is set to RPROC_DETACHED if the resource table is found
in the memory. However, this can be wrong if the remote is not started,
but firmware is still loaded in the memory. Use PM_GET_NODE_STATUS call
to the firmware to request the state of the RPU node. If the RPU is
actually out of reset and running, only then move the remote state to
RPROC_DETACHED, otherwise keep the remote state to RPROC_OFFLINE.

Signed-off-by: Tanmay Shah &lt;tanmay.shah@amd.com&gt;
Fixes: bca4b02ef92e ("remoteproc: xlnx: Add attach detach support")
Reviewed-by: Beleswar Padhi &lt;b-padhi@ti.com&gt;
Acked-by: Michal Simek &lt;michal.simek@amd.com&gt;
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260428221855.313752-1-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier &lt;mathieu.poirier@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a48df51d23138388900995add2854cda4aa68e55 upstream.

The remote state is set to RPROC_DETACHED if the resource table is found
in the memory. However, this can be wrong if the remote is not started,
but firmware is still loaded in the memory. Use PM_GET_NODE_STATUS call
to the firmware to request the state of the RPU node. If the RPU is
actually out of reset and running, only then move the remote state to
RPROC_DETACHED, otherwise keep the remote state to RPROC_OFFLINE.

Signed-off-by: Tanmay Shah &lt;tanmay.shah@amd.com&gt;
Fixes: bca4b02ef92e ("remoteproc: xlnx: Add attach detach support")
Reviewed-by: Beleswar Padhi &lt;b-padhi@ti.com&gt;
Acked-by: Michal Simek &lt;michal.simek@amd.com&gt;
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260428221855.313752-1-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier &lt;mathieu.poirier@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: samsung: acpm: remove compile-testing stubs</title>
<updated>2026-07-24T14:19:24+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2026-05-29T13:43:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f0115af6746eaee0232cefb6f38048a14c06cffb'/>
<id>f0115af6746eaee0232cefb6f38048a14c06cffb</id>
<content type='text'>
[ Upstream commit 7b661285aa7507eab79efff0a418445157db4141 ]

Sashiko reported an inconsistent use of NULL vs ERR_PTR()
returns in the stub helpers in xynos-acpm-protocol.h.

Since this only happens on dead code for COMPILE_TEST=y, this is not
really a bug though.  Having stub functions that return NULL is a common
way to define optional interfaces, where callers still work when the
feature is disabled, though this clearly does not work for acpm because
some callers have a NULL pointer dereference when compile testing.

Since CONFIG_EXYNOS_ACPM_PROTOCOL already supports compile-testing itself,
and all (both) drivers using it clearly require the support, so this
just simplifies the option space without losing any build coverage.

Remove the stub functions entirely and adjust the one Kconfig
dependency to require EXYNOS_ACPM_PROTOCOL unconditionally.

Fixes: 6837c006d4e7 ("firmware: exynos-acpm: add empty method to allow compile test")
Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org
Link: https://lore.kernel.org/all/a7994860-24a3-4f87-84bf-109ed653dda4@linaro.org/
Reviewed-by: Tudor Ambarus &lt;tudor.ambarus@linaro.org&gt;
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Link: https://patch.msgid.link/20260529134454.2147446-1-arnd@kernel.org
[krzk: Rebase on difference in devm_acpm_get_by_node()]
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 7b661285aa7507eab79efff0a418445157db4141 ]

Sashiko reported an inconsistent use of NULL vs ERR_PTR()
returns in the stub helpers in xynos-acpm-protocol.h.

Since this only happens on dead code for COMPILE_TEST=y, this is not
really a bug though.  Having stub functions that return NULL is a common
way to define optional interfaces, where callers still work when the
feature is disabled, though this clearly does not work for acpm because
some callers have a NULL pointer dereference when compile testing.

Since CONFIG_EXYNOS_ACPM_PROTOCOL already supports compile-testing itself,
and all (both) drivers using it clearly require the support, so this
just simplifies the option space without losing any build coverage.

Remove the stub functions entirely and adjust the one Kconfig
dependency to require EXYNOS_ACPM_PROTOCOL unconditionally.

Fixes: 6837c006d4e7 ("firmware: exynos-acpm: add empty method to allow compile test")
Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org
Link: https://lore.kernel.org/all/a7994860-24a3-4f87-84bf-109ed653dda4@linaro.org/
Reviewed-by: Tudor Ambarus &lt;tudor.ambarus@linaro.org&gt;
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Link: https://patch.msgid.link/20260529134454.2147446-1-arnd@kernel.org
[krzk: Rebase on difference in devm_acpm_get_by_node()]
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper</title>
<updated>2026-07-24T14:19:24+00:00</updated>
<author>
<name>Tudor Ambarus</name>
<email>tudor.ambarus@linaro.org</email>
</author>
<published>2026-05-15T09:32:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=75c70913d30c3b3c395a4efa0d8c0e9c90553fa7'/>
<id>75c70913d30c3b3c395a4efa0d8c0e9c90553fa7</id>
<content type='text'>
[ Upstream commit fc13a4b9b9c8cb0b8e5ba54b21712d00f810496c ]

Introduce devm_acpm_get_by_phandle() to standardize how consumer
drivers acquire a handle to the ACPM IPC interface. Enforce the
use of the "samsung,acpm-ipc" property name across the SoC and
simplify the boilerplate code in client drivers.

The first consumer of this helper is the Exynos ACPM Thermal Management
Unit (TMU) driver. The TMU utilizes a hybrid management approach: direct
register access from the Application Processor (AP) is restricted to the
interrupt pending (INTPEND) registers for event identification.
High-level functional tasks, such as sensor initialization, threshold
programming, and temperature reads, are delegated to the ACPM firmware
via this IPC interface.

Signed-off-by: Tudor Ambarus &lt;tudor.ambarus@linaro.org&gt;
Reviewed-by: Peter Griffin &lt;peter.griffin@linaro.org&gt;
Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-6-8ca011d5a965@linaro.org
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
Stable-dep-of: 7b661285aa75 ("firmware: samsung: acpm: remove compile-testing stubs")
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit fc13a4b9b9c8cb0b8e5ba54b21712d00f810496c ]

Introduce devm_acpm_get_by_phandle() to standardize how consumer
drivers acquire a handle to the ACPM IPC interface. Enforce the
use of the "samsung,acpm-ipc" property name across the SoC and
simplify the boilerplate code in client drivers.

The first consumer of this helper is the Exynos ACPM Thermal Management
Unit (TMU) driver. The TMU utilizes a hybrid management approach: direct
register access from the Application Processor (AP) is restricted to the
interrupt pending (INTPEND) registers for event identification.
High-level functional tasks, such as sensor initialization, threshold
programming, and temperature reads, are delegated to the ACPM firmware
via this IPC interface.

Signed-off-by: Tudor Ambarus &lt;tudor.ambarus@linaro.org&gt;
Reviewed-by: Peter Griffin &lt;peter.griffin@linaro.org&gt;
Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-6-8ca011d5a965@linaro.org
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
Stable-dep-of: 7b661285aa75 ("firmware: samsung: acpm: remove compile-testing stubs")
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc</title>
<updated>2026-04-17T03:34:34+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-04-17T03:34:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=31b43c079f9aa55754c20404a42bca9a49e01f60'/>
<id>31b43c079f9aa55754c20404a42bca9a49e01f60</id>
<content type='text'>
Pull SoC driver updates from Arnd Bergmann:
 "The driver updates again are all over the place with many minor fixes
  going into platform specific code. The most notable changes are:

   - Support for Microchip pic64gx system controllers
   - Work on cleaning up devicetree bindings for SoC drivers, and
     converting them into the new format
   - Lots of smaller changes for Qualcomm SoC drivers, including support
     for a number of newly supported chips
   - reset controller API cleanups and a new driver for Cix Sky1
   - Reworks of the Tegra PMC and CBB drivers, along with a change to
     how individual Tegra SoCs get selected in Kconfig and BPMP firmware
     driver updates including a refresh of the ABI header to match the
     version used by firmware
   - STM32 updates to the firewall bus driver and support for the debug
     bus through OP-TEE
   - SCMI firmware driver improvements for reliability, in particular
     for dealing with broken firmware interrupts
   - Memory driver updates for Tegra, and a patch to remove the unused
     Baikal T1 driver"

* tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (193 commits)
  firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
  firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X
  clk: spear: fix resource leak in clk_register_vco_pll()
  reset: rzv2h-usb2phy: Add support for VBUS mux controller registration
  reset: rzv2h-usb2phy: Convert to regmap API
  dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset
  dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property
  soc: microchip: add mpfs gpio interrupt mux driver
  dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux
  gpio: mpfs: Add interrupt support
  soc: qcom: ubwc: add helpers to get programmable values
  soc: qcom: ubwc: add helper to get min_acc length
  firmware: qcom: scm: Register gunyah watchdog device
  soc: qcom: socinfo: Add SoC ID for SA8650P
  dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P
  firmware: qcom: scm: Allow QSEECOM on Mahua CRD
  soc: qcom: wcnss: simplify allocation of req
  soc: qcom: pd-mapper: Add support for Eliza
  soc: qcom: aoss: compare against normalized cooling state
  soc: qcom: llcc: fix v1 SB syndrome register offset
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull SoC driver updates from Arnd Bergmann:
 "The driver updates again are all over the place with many minor fixes
  going into platform specific code. The most notable changes are:

   - Support for Microchip pic64gx system controllers
   - Work on cleaning up devicetree bindings for SoC drivers, and
     converting them into the new format
   - Lots of smaller changes for Qualcomm SoC drivers, including support
     for a number of newly supported chips
   - reset controller API cleanups and a new driver for Cix Sky1
   - Reworks of the Tegra PMC and CBB drivers, along with a change to
     how individual Tegra SoCs get selected in Kconfig and BPMP firmware
     driver updates including a refresh of the ABI header to match the
     version used by firmware
   - STM32 updates to the firewall bus driver and support for the debug
     bus through OP-TEE
   - SCMI firmware driver improvements for reliability, in particular
     for dealing with broken firmware interrupts
   - Memory driver updates for Tegra, and a patch to remove the unused
     Baikal T1 driver"

* tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (193 commits)
  firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
  firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X
  clk: spear: fix resource leak in clk_register_vco_pll()
  reset: rzv2h-usb2phy: Add support for VBUS mux controller registration
  reset: rzv2h-usb2phy: Convert to regmap API
  dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset
  dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property
  soc: microchip: add mpfs gpio interrupt mux driver
  dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux
  gpio: mpfs: Add interrupt support
  soc: qcom: ubwc: add helpers to get programmable values
  soc: qcom: ubwc: add helper to get min_acc length
  firmware: qcom: scm: Register gunyah watchdog device
  soc: qcom: socinfo: Add SoC ID for SA8650P
  dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P
  firmware: qcom: scm: Allow QSEECOM on Mahua CRD
  soc: qcom: wcnss: simplify allocation of req
  soc: qcom: pd-mapper: Add support for Eliza
  soc: qcom: aoss: compare against normalized cooling state
  soc: qcom: llcc: fix v1 SB syndrome register offset
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound</title>
<updated>2026-04-15T16:20:49+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-04-15T16:20:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a8e7ef3cec99ba2487110e01d77a8a278593b3e9'/>
<id>a8e7ef3cec99ba2487110e01d77a8a278593b3e9</id>
<content type='text'>
Pull sound updates from Takashi Iwai:
 "Nothing too thrilling here, but we see lots of driver updates and bug
  fixes, including quirk additions and refactoring works, while there
  have been little changes in the core functionality. Here are some
  highlights:

  Core:
   - Add validation for the control API put callback
   - Fixes in compress-offload API timestamp handling
   - Continued ASoC core API cleanups

  ASoC:
   - Add support for bus keepers (for Apple devices in future)
   - Enhancements to the SDCA support, including retaskable jacks
   - Test improvements for Cirrus Logic drivers
   - Lots of fixes for the NXP, nVidia and Qualcomm
   - Support for AMD RPL DMIC, Cirrus Logic CS42L43 and CS47L47, nVidia
     machines with CPCAP and WM8962

  USB-audio:
   - Quirks for Huawei Headset, Focusrite Novation, MV-Silicon, Studio
     1824, Arturia AF16Rig, Hotone Audio, Feaulle Rainbow, PreSonus
     AudioBox, Moondrop Ju Jiu, Scarlett 18i20, etc
   - Extended mixer volume quirk handling
   - UAF and other fixes for us144mkii, 6fire and caiaq drivers

  HD-audio:
   - Add quirks or fixes for Acer, Lenovo, HP, ASUS machines
   - Fixes &amp; cleanups of GPIO helper code

  Misc:
   - Add suspend/resume support for multiple legacy ISA and Apple
     drivers
   - Further regression fixes for ctxfi driver"

* tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (359 commits)
  ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
  ALSA: usb-audio: Fix missing error handling for get_min_max*()
  ALSA: hda/realtek - fixed speaker no sound update
  ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic
  ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP
  ALSA: hda/realtek: Add quirk for Legion S7 15IMH
  ALSA: hda/realtek: Add quirk for HP Spectre x360 14-ea
  ALSA: caiaq: take a reference on the USB device in create_card()
  ASoC: dt-bindings: rockchip: convert rk3399-gru-sound to DT Schema
  ALSA: sscape: Add suspend and resume support
  ALSA: sscape: Cache per-card resources for board reinitialization
  ALSA: usb-audio: Do not expose sticky mixers
  ALSA: usb-audio: Move volume control resolution check into a function
  ALSA: usb-audio: Add error checks against get_min_max*()
  ALSA: usb-audio: Add quirk for PreSonus AudioBox USB
  ALSA: interwave: guard PM-only restore helpers with CONFIG_PM
  ALSA: usb-audio: Evaluate packsize caps at the right place
  ALSA: sc6000: Restore board setup across suspend
  ALSA: sc6000: Keep the programmed board state in card-private data
  ALSA: 6fire: fix use-after-free on disconnect
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull sound updates from Takashi Iwai:
 "Nothing too thrilling here, but we see lots of driver updates and bug
  fixes, including quirk additions and refactoring works, while there
  have been little changes in the core functionality. Here are some
  highlights:

  Core:
   - Add validation for the control API put callback
   - Fixes in compress-offload API timestamp handling
   - Continued ASoC core API cleanups

  ASoC:
   - Add support for bus keepers (for Apple devices in future)
   - Enhancements to the SDCA support, including retaskable jacks
   - Test improvements for Cirrus Logic drivers
   - Lots of fixes for the NXP, nVidia and Qualcomm
   - Support for AMD RPL DMIC, Cirrus Logic CS42L43 and CS47L47, nVidia
     machines with CPCAP and WM8962

  USB-audio:
   - Quirks for Huawei Headset, Focusrite Novation, MV-Silicon, Studio
     1824, Arturia AF16Rig, Hotone Audio, Feaulle Rainbow, PreSonus
     AudioBox, Moondrop Ju Jiu, Scarlett 18i20, etc
   - Extended mixer volume quirk handling
   - UAF and other fixes for us144mkii, 6fire and caiaq drivers

  HD-audio:
   - Add quirks or fixes for Acer, Lenovo, HP, ASUS machines
   - Fixes &amp; cleanups of GPIO helper code

  Misc:
   - Add suspend/resume support for multiple legacy ISA and Apple
     drivers
   - Further regression fixes for ctxfi driver"

* tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (359 commits)
  ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
  ALSA: usb-audio: Fix missing error handling for get_min_max*()
  ALSA: hda/realtek - fixed speaker no sound update
  ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic
  ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP
  ALSA: hda/realtek: Add quirk for Legion S7 15IMH
  ALSA: hda/realtek: Add quirk for HP Spectre x360 14-ea
  ALSA: caiaq: take a reference on the USB device in create_card()
  ASoC: dt-bindings: rockchip: convert rk3399-gru-sound to DT Schema
  ALSA: sscape: Add suspend and resume support
  ALSA: sscape: Cache per-card resources for board reinitialization
  ALSA: usb-audio: Do not expose sticky mixers
  ALSA: usb-audio: Move volume control resolution check into a function
  ALSA: usb-audio: Add error checks against get_min_max*()
  ALSA: usb-audio: Add quirk for PreSonus AudioBox USB
  ALSA: interwave: guard PM-only restore helpers with CONFIG_PM
  ALSA: usb-audio: Evaluate packsize caps at the right place
  ALSA: sc6000: Restore board setup across suspend
  ALSA: sc6000: Keep the programmed board state in card-private data
  ALSA: 6fire: fix use-after-free on disconnect
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: thead: Fix buffer overflow and use standard endian macros</title>
<updated>2026-04-01T11:03:07+00:00</updated>
<author>
<name>Michal Wilczynski</name>
<email>m.wilczynski@samsung.com</email>
</author>
<published>2025-04-03T13:10:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=88c4bd90725557796c15878b7cb70066e9e6b5ab'/>
<id>88c4bd90725557796c15878b7cb70066e9e6b5ab</id>
<content type='text'>
Addresses two issues in the TH1520 AON firmware protocol driver:

1. Fix a potential buffer overflow where the code used unsafe pointer
   arithmetic to access the 'mode' field through the 'resource' pointer
   with an offset. This was flagged by Smatch static checker as:
   "buffer overflow 'data' 2 &lt;= 3"

2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard
   kernel endianness conversion macros (cpu_to_be16, etc.) for better
   portability and maintainability.

The functionality was re-tested with the GPU power-up sequence,
confirming the GPU powers up correctly and the driver probes
successfully.

[   12.702370] powervr ffef400000.gpu: [drm] loaded firmware
powervr/rogue_36.52.104.182_v1.fw
[   12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build
6645434 OS)
[   12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on
minor 0

Fixes: e4b3cbd840e5 ("firmware: thead: Add AON firmware protocol driver")
Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Closes: https://lore.kernel.org/all/17a0ccce-060b-4b9d-a3c4-8d5d5823b1c9@stanley.mountain/
Signed-off-by: Michal Wilczynski &lt;m.wilczynski@samsung.com&gt;
Reviewed-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Acked-by: Drew Fustini &lt;fustini@kernel.org&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Addresses two issues in the TH1520 AON firmware protocol driver:

1. Fix a potential buffer overflow where the code used unsafe pointer
   arithmetic to access the 'mode' field through the 'resource' pointer
   with an offset. This was flagged by Smatch static checker as:
   "buffer overflow 'data' 2 &lt;= 3"

2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard
   kernel endianness conversion macros (cpu_to_be16, etc.) for better
   portability and maintainability.

The functionality was re-tested with the GPU power-up sequence,
confirming the GPU powers up correctly and the driver probes
successfully.

[   12.702370] powervr ffef400000.gpu: [drm] loaded firmware
powervr/rogue_36.52.104.182_v1.fw
[   12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build
6645434 OS)
[   12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on
minor 0

Fixes: e4b3cbd840e5 ("firmware: thead: Add AON firmware protocol driver")
Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Closes: https://lore.kernel.org/all/17a0ccce-060b-4b9d-a3c4-8d5d5823b1c9@stanley.mountain/
Signed-off-by: Michal Wilczynski &lt;m.wilczynski@samsung.com&gt;
Reviewed-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Acked-by: Drew Fustini &lt;fustini@kernel.org&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ASoC: amd: Move to GPIO descriptors</title>
<updated>2026-03-16T01:11:23+00:00</updated>
<author>
<name>Mark Brown</name>
<email>broonie@kernel.org</email>
</author>
<published>2026-03-16T01:11:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=3e9cda2f4a33c6becc99f8a78946cbd02983852f'/>
<id>3e9cda2f4a33c6becc99f8a78946cbd02983852f</id>
<content type='text'>
Linus Walleij &lt;linusw@kernel.org&gt; says:

After a quick look and test-compile I can determine that
all of these drivers include &lt;linux/gpio.h&gt; for no reason
whatsoever, so fixing it is low hanging fruit.

Link: https://patch.msgid.link/20260314-asoc-amd-v1-0-31afed06e022@kernel.org
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Linus Walleij &lt;linusw@kernel.org&gt; says:

After a quick look and test-compile I can determine that
all of these drivers include &lt;linux/gpio.h&gt; for no reason
whatsoever, so fixing it is low hanging fruit.

Link: https://patch.msgid.link/20260314-asoc-amd-v1-0-31afed06e022@kernel.org
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: stratix10-svc: Add Multi SVC clients support</title>
<updated>2026-03-10T16:32:31+00:00</updated>
<author>
<name>Muhammad Amirul Asyraf Mohamad Jamian</name>
<email>muhammad.amirul.asyraf.mohamad.jamian@altera.com</email>
</author>
<published>2026-03-05T09:31:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=22fd7f7fed2ae3702f90d1985c326354e86b9c75'/>
<id>22fd7f7fed2ae3702f90d1985c326354e86b9c75</id>
<content type='text'>
In the current implementation, SVC client drivers such as socfpga-hwmon,
intel_fcs, stratix10-soc, stratix10-rsu each send an SMC command that
triggers a single thread in the stratix10-svc driver. Upon receiving a
callback, the initiating client driver sends a stratix10-svc-done signal,
terminating the thread without waiting for other pending SMC commands to
complete. This leads to a timeout issue in the firmware SVC mailbox service
when multiple client drivers send SMC commands concurrently.

To resolve this issue, a dedicated thread is now created per channel. The
stratix10-svc driver will support up to the number of channels defined by
SVC_NUM_CHANNEL. Thread synchronization is handled using a mutex to prevent
simultaneous issuance of SMC commands by multiple threads.

SVC_NUM_DATA_IN_FIFO is reduced from 32 to 8, since each channel now has
its own dedicated FIFO and the SDM processes commands one at a time.
8 entries per channel is sufficient while keeping the total aggregate
capacity the same (4 channels x 8 = 32 entries).

Additionally, a thread task is now validated before invoking kthread_stop
when the user aborts, ensuring safe termination.

Timeout values have also been adjusted to accommodate the increased load
from concurrent client driver activity.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ang Tien Sung &lt;tien.sung.ang@altera.com&gt;
Signed-off-by: Fong, Yan Kei &lt;yankei.fong@altera.com&gt;
Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian &lt;muhammad.amirul.asyraf.mohamad.jamian@altera.com&gt;
Link: https://lore.kernel.org/all/20260305093151.2678-1-muhammad.amirul.asyraf.mohamad.jamian@altera.com
Signed-off-by: Dinh Nguyen &lt;dinguyen@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In the current implementation, SVC client drivers such as socfpga-hwmon,
intel_fcs, stratix10-soc, stratix10-rsu each send an SMC command that
triggers a single thread in the stratix10-svc driver. Upon receiving a
callback, the initiating client driver sends a stratix10-svc-done signal,
terminating the thread without waiting for other pending SMC commands to
complete. This leads to a timeout issue in the firmware SVC mailbox service
when multiple client drivers send SMC commands concurrently.

To resolve this issue, a dedicated thread is now created per channel. The
stratix10-svc driver will support up to the number of channels defined by
SVC_NUM_CHANNEL. Thread synchronization is handled using a mutex to prevent
simultaneous issuance of SMC commands by multiple threads.

SVC_NUM_DATA_IN_FIFO is reduced from 32 to 8, since each channel now has
its own dedicated FIFO and the SDM processes commands one at a time.
8 entries per channel is sufficient while keeping the total aggregate
capacity the same (4 channels x 8 = 32 entries).

Additionally, a thread task is now validated before invoking kthread_stop
when the user aborts, ensuring safe termination.

Timeout values have also been adjusted to accommodate the increased load
from concurrent client driver activity.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ang Tien Sung &lt;tien.sung.ang@altera.com&gt;
Signed-off-by: Fong, Yan Kei &lt;yankei.fong@altera.com&gt;
Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian &lt;muhammad.amirul.asyraf.mohamad.jamian@altera.com&gt;
Link: https://lore.kernel.org/all/20260305093151.2678-1-muhammad.amirul.asyraf.mohamad.jamian@altera.com
Signed-off-by: Dinh Nguyen &lt;dinguyen@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: cs_dsp: Add API to hibernate the DSP</title>
<updated>2026-03-01T23:48:37+00:00</updated>
<author>
<name>Stefan Binding</name>
<email>sbinding@opensource.cirrus.com</email>
</author>
<published>2026-02-24T16:18:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=73942a6ea26bd7e02b7c260b8b7aa942397be894'/>
<id>73942a6ea26bd7e02b7c260b8b7aa942397be894</id>
<content type='text'>
For some parts, the DSP is kept running when in low power mode
(hibernation), leaving the firmware ALSA controls enabled, but the
registers are inaccessible. Attempts to access volatile firmware
controls whilst in this state would produce errors in the kernel log
due to a regmap_raw_read() into DSP registers whilst the regmap is in
cache_only.

To remove this error log, add a hibernating flag to indicate that the
controls are inaccessible, so we no longer try to read or write to the
registers whilst the regmap is in cache_only.

This would still produce an error when trying to read or write to these
controls, but this would be a different error (-EPERM instead of
-EBUSY), and would not produce a spurious error log in the kernel.

Upon wake from hibernation, the control caches are re-synced to the
hardware, if the DSP is running.

Signed-off-by: Stefan Binding &lt;sbinding@opensource.cirrus.com&gt;
Link: https://patch.msgid.link/20260224161821.93365-2-sbinding@opensource.cirrus.com
Reviewed-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For some parts, the DSP is kept running when in low power mode
(hibernation), leaving the firmware ALSA controls enabled, but the
registers are inaccessible. Attempts to access volatile firmware
controls whilst in this state would produce errors in the kernel log
due to a regmap_raw_read() into DSP registers whilst the regmap is in
cache_only.

To remove this error log, add a hibernating flag to indicate that the
controls are inaccessible, so we no longer try to read or write to the
registers whilst the regmap is in cache_only.

This would still produce an error when trying to read or write to these
controls, but this would be a different error (-EPERM instead of
-EBUSY), and would not produce a spurious error log in the kernel.

Upon wake from hibernation, the control caches are re-synced to the
hardware, if the DSP is running.

Signed-off-by: Stefan Binding &lt;sbinding@opensource.cirrus.com&gt;
Link: https://patch.msgid.link/20260224161821.93365-2-sbinding@opensource.cirrus.com
Reviewed-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firmware: exynos-acpm: Drop fake 'const' on handle pointer</title>
<updated>2026-02-28T14:47:03+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>krzysztof.kozlowski@oss.qualcomm.com</email>
</author>
<published>2026-02-24T10:42:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a2be37eedb52ea26938fa4cc9de1ff84963c57ad'/>
<id>a2be37eedb52ea26938fa4cc9de1ff84963c57ad</id>
<content type='text'>
All the functions operating on the 'handle' pointer are claiming it is a
pointer to const thus they should not modify the handle.  In fact that's
a false statement, because first thing these functions do is drop the
cast to const with container_of:

  struct acpm_info *acpm = handle_to_acpm_info(handle);

And with such cast the handle is easily writable with simple:

  acpm-&gt;handle.ops.pmic_ops.read_reg = NULL;

The code is not correct logically, either, because functions like
acpm_get_by_node() and acpm_handle_put() are meant to modify the handle
reference counting, thus they must modify the handle.  Modification here
happens anyway, even if the reference counting is stored in the
container which the handle is part of.

The code does not have actual visible bug, but incorrect 'const'
annotations could lead to incorrect compiler decisions.

Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski &lt;krzysztof.kozlowski@oss.qualcomm.com&gt;
Link: https://patch.msgid.link/20260224104203.42950-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
All the functions operating on the 'handle' pointer are claiming it is a
pointer to const thus they should not modify the handle.  In fact that's
a false statement, because first thing these functions do is drop the
cast to const with container_of:

  struct acpm_info *acpm = handle_to_acpm_info(handle);

And with such cast the handle is easily writable with simple:

  acpm-&gt;handle.ops.pmic_ops.read_reg = NULL;

The code is not correct logically, either, because functions like
acpm_get_by_node() and acpm_handle_put() are meant to modify the handle
reference counting, thus they must modify the handle.  Modification here
happens anyway, even if the reference counting is stored in the
container which the handle is part of.

The code does not have actual visible bug, but incorrect 'const'
annotations could lead to incorrect compiler decisions.

Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski &lt;krzysztof.kozlowski@oss.qualcomm.com&gt;
Link: https://patch.msgid.link/20260224104203.42950-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Krzysztof Kozlowski &lt;krzk@kernel.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
