linux-stable.git/drivers/mfd, branch v7.2.4 Linux kernel stable tree mfd: sm501: Fix potential memory leaks during remove 2026-09-07T15:37:21+00:00 Abdun Nihaal nihaal@cse.iitm.ac.in 2026-07-20T11:38:32+00:00 c8be3a076a59ec793fb2e4bdb830a709aaea9cce commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d upstream. The memory allocated for struct sm501_devdata in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to kfree(). Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d upstream.

The memory allocated for struct sm501_devdata in sm501_pci_probe() and
sm501_plat_probe() is not freed by the corresponding remove functions
sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to
kfree().

Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: qnap-mcu: keep the reply buffer alive past a command timeout 2026-09-07T15:37:21+00:00 Ali Ahmet Memis ali@iusegentoo.com 2026-08-02T13:53:07+00:00 8391ee06d08845a0a165b5fe679ba326915166b2 commit 47504742cea7878ebd1bf1491bbed923df6b90b1 upstream. qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]; ... reply->data = rx; reply->length = length; and qnap_mcu_receive_buf() writes into it from the serdev receive path, which runs out of flush_to_ldisc() and is not serialized against qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec() holds that mutex across wait_for_completion_timeout(). On a timeout qnap_mcu_exec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnap_mcu_write() fails, since that path returns without touching the reply state either. Move the receive buffer into struct qnap_mcu. It is 37 bytes and the structure is devm_kzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. bus_lock keeps commands from sharing it. This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both after its if (!reply->length) return size; check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnap_mcu_exec() has already checked against sizeof(mcu->rx). Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/ Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 47504742cea7878ebd1bf1491bbed923df6b90b1 upstream.

qnap_mcu_exec() publishes an on-stack buffer to the receive path:

	unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];
	...
	reply->data = rx;
	reply->length = length;

and qnap_mcu_receive_buf() writes into it from the serdev receive path,
which runs out of flush_to_ldisc() and is not serialized against
qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec()
holds that mutex across wait_for_completion_timeout().

On a timeout qnap_mcu_exec() returns with reply->data still pointing at
its own frame. A reply that arrives late, or an unsolicited message from
the MCU, is then written into a stack frame that has been left, corrupting
whatever runs next on that stack. The same applies when qnap_mcu_write()
fails, since that path returns without touching the reply state either.

Move the receive buffer into struct qnap_mcu. It is 37 bytes and the
structure is devm_kzalloc()ed, so it lives as long as the driver, and a
late write lands in memory that is still valid and is reinitialized by the
next command. bus_lock keeps commands from sharing it.

This deliberately does not clear reply->data or reply->length on the
timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both
after its

	if (!reply->length)
		return size;

check: clearing reply->data gives a NULL dereference, and clearing
reply->length alone removes the reply->received == reply->length exit
condition, so the copy loop runs until the uart chunk is consumed and
overruns the buffer. Leaving both set keeps the write bounded by
reply->length, which qnap_mcu_exec() has already checked against
sizeof(mcu->rx).

Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/
Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: cgbc: Fix teardown ordering in cgbc_remove() 2026-09-07T15:37:21+00:00 Thomas Richard thomas.richard@bootlin.com 2026-07-13T14:43:43+00:00 3266537d0333a6a43fa07fdb1320ed61d6753c66 commit 2970c2db8ab3d97ea6250c14ca49b1e1731115ab upstream. Release Board Controller session once children are removed by the core. Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/cover.1783507945.git.u.kleine-koenig%40baylibre.com?part=19 Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver") Signed-off-by: Thomas Richard <thomas.richard@bootlin.com> Link: https://patch.msgid.link/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a@bootlin.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2970c2db8ab3d97ea6250c14ca49b1e1731115ab upstream.

Release Board Controller session once children are removed by the core.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1783507945.git.u.kleine-koenig%40baylibre.com?part=19
Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver")
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03T05:38:17+00:00 Uwe Kleine-König (The Capable Hub) u.kleine-koenig@baylibre.com 2026-06-30T09:24:36+00:00 995832b2cebe6969d1b42635db698803ee31294d Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> 
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Merge tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd 2026-06-18T21:26:29+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-18T21:26:29+00:00 6beaec3aee9852438b89e4d7891caf5e84d45851 Pull MFD updates from Lee Jones: "New Support & Features: - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger, MUIC, flash and RGB LED controllers - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip - Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager Improvements & Fixes: - Core: Unify the user-visible company name to "Qualcomm" across various config options - ChromeOS EC: - Delay `dev_set_drvdata()` until the probe process has successfully completed to avoid use-after-free issues - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already defined in Device Tree or ACPI - Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds memory access during firmware loading - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to support board files requesting GPIOs - Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC - Renesas RSMU: Fix page register setup for the 8A3400x family by correctly calculating the page address - Renesas RZ/MTU3: - Make the reset line optional to support newer SoC variants (RZ/T2H, RZ/N2H) - Modernize the driver by using device-managed APIs for reset control and device addition - Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress unnecessary "DMA mask not set" messages - Silicon Motion SM501: Fix a reference leak on failed device registration by properly dropping the platform device reference - Texas Instruments: - TPS65219: Make poweroff handler registration conditional on the "system-power-controller" Device Tree property - TPS6586x: Fix Device Tree node reference counting by manually bumping the refcount for sub-devices - TPS65910: Add return value checking for the dummy I2C transfer used to work around silicon erratum SWCZ010 - TWL4030: Update board-specific checks to use Device Tree compatibles instead of legacy machine IDs Cleanups & Refactoring: - Core: Consistently define `pci_device_id` arrays using named initializers across various Intel and Silicon Motion drivers - Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik - Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro comments - MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()` as returning a boolean status - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity - Silicon Labs Si476x: Fix various spelling mistakes in driver comments - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell tables for each PMIC model - Timberdale: Move GPIO pin definitions into the driver and transition to using a software node for the GPIO cell - Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member Device Tree Binding Updates: - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin controllers - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema - Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU - MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for the MT6359 variant - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks - Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible string due to documentation errors - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC, flash and RGB LEDs) - Spreadtrum SC2731: Include regulator bindings for the SC2730 variant - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the PWM subnode - Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792 variant Removals: - Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX phones" * tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits) dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode mfd: rz-mtu3: Make reset optional mfd: rz-mtu3: Store &pdev->dev in local variable mfd: rz-mtu3: Use local variable for reset mfd: rz-mtu3: Use device-managed APIs dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl mfd: tps6586x: Fix OF node refcount dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings mfd: twl4030-power: Update checks for specific boards to use the DT dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block mfd: qcom_rpm: Add msm8960 QDSS clock resource mfd: si476x-i2c: Fix spelling mistakes in comments mfd: max77620: Convert poweroff support to sys-off API mfd: dt-bindings: mt6397: Add regulator supplies dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359 mfd: cs42l43: Sanity check firmware size mfd: qcom: Unify user-visible "Qualcomm" name mfd: cros_ec: Delay dev_set_drvdata() until probe success ... 
Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
     includes charger, MUIC, flash and RGB LED controllers
   - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
   - Texas Instruments BQ25792: Add support for the TI BQ25792 charger
     manager

  Improvements & Fixes:
   - Core: Unify the user-visible company name to "Qualcomm" across
     various config options
   - ChromeOS EC:
       - Delay `dev_set_drvdata()` until the probe process has
         successfully completed to avoid use-after-free issues
       - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is
         already defined in Device Tree or ACPI
   - Cirrus Logic CS42L43: Add a sanity check for firmware size to
     prevent out-of-bounds memory access during firmware loading
   - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated
     software node to support board files requesting GPIOs
   - Maxim MAX77620: Modernize poweroff handling by converting to the
     sys-off API
   - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960
     SoC
   - Renesas RSMU: Fix page register setup for the 8A3400x family by
     correctly calculating the page address
   - Renesas RZ/MTU3:
       - Make the reset line optional to support newer SoC variants
         (RZ/T2H, RZ/N2H)
       - Modernize the driver by using device-managed APIs for reset
         control and device addition
   - Samsung Core: Set the coherent DMA mask to zero for the Samsung
     PMIC device to suppress unnecessary "DMA mask not set" messages
   - Silicon Motion SM501: Fix a reference leak on failed device
     registration by properly dropping the platform device reference
   - Texas Instruments:
       - TPS65219: Make poweroff handler registration conditional on the
         "system-power-controller" Device Tree property
       - TPS6586x: Fix Device Tree node reference counting by manually
         bumping the refcount for sub-devices
       - TPS65910: Add return value checking for the dummy I2C transfer
         used to work around silicon erratum SWCZ010
       - TWL4030: Update board-specific checks to use Device Tree
         compatibles instead of legacy machine IDs

  Cleanups & Refactoring:
   - Core: Consistently define `pci_device_id` arrays using named
     initializers across various Intel and Silicon Motion drivers
   - Maintainers: Shift maintenance of Samsung PMIC drivers to André
     Draszik
   - Maxim MAX77759: Improve code style by reformatting the IRQ table
     and refining macro comments
   - MEN MENF21BMC / Texas Instruments TWL: Correctly treat
     `i2c_check_functionality()` as returning a boolean status
   - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code
     clarity
   - Silicon Labs Si476x: Fix various spelling mistakes in driver
     comments
   - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and
     separate MFD cell tables for each PMIC model
   - Timberdale: Move GPIO pin definitions into the driver and
     transition to using a software node for the GPIO cell
   - Wolfson WM8994: Remove dead legacy-GPIO code and its associated
     `irq_gpio` member

  Device Tree Binding Updates:
   - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its
     SoC0/SoC1 pin controllers
   - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format
     to YAML DT schema
   - Khadas MCU: Add a new compatible and fan-supply property for the
     Khadas VIM4 MCU
   - MediaTek MT6397: Add support for the MT6365 PMIC and document
     regulator supplies for the MT6359 variant
   - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
   - Renesas RZ/G3L: Revert the addition of the
     `renesas,r9a08g046-lvds-cmn` compatible string due to documentation
     errors
   - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices
     (charger, MUIC, flash and RGB LEDs)
   - Spreadtrum SC2731: Include regulator bindings for the SC2730
     variant
   - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as
     required for the PWM subnode
   - Texas Instruments BQ257xx: Expand the BQ25703A binding to include
     the BQ25792 variant

  Removals:
   - Motorola EZX PCAP: Remove the unused and non-functional driver for
     Motorola EZX phones"

* tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
  dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
  dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
  mfd: rz-mtu3: Make reset optional
  mfd: rz-mtu3: Store &pdev->dev in local variable
  mfd: rz-mtu3: Use local variable for reset
  mfd: rz-mtu3: Use device-managed APIs
  dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
  mfd: tps6586x: Fix OF node refcount
  dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
  mfd: twl4030-power: Update checks for specific boards to use the DT
  dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
  mfd: qcom_rpm: Add msm8960 QDSS clock resource
  mfd: si476x-i2c: Fix spelling mistakes in comments
  mfd: max77620: Convert poweroff support to sys-off API
  mfd: dt-bindings: mt6397: Add regulator supplies
  dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
  dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
  mfd: cs42l43: Sanity check firmware size
  mfd: qcom: Unify user-visible "Qualcomm" name
  mfd: cros_ec: Delay dev_set_drvdata() until probe success
  ...
Merge tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc 2026-06-17T18:21:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-17T18:21:40+00:00 70cb95c736807da2c4952423c9f9afe470341996 Pull SoC driver updates from Arnd Bergmann: "There are a few added drivers, but mostly the normal maintenance to drivers for firmware, memory controller and other soc specific hardware: - The NXP QuickEngine gets modern MSI support, which allows some cleanups to the GICv3 irqchip chip driver - A new SoC specific driver for the Renesas R-Car MFIS unit is added, encapsulating support for the on-chip mailbox and hwspinlock implementations that are not easily separated into individual drivers - The Qualcomm SoC drivers add support for additional SoC implementations, and flexibility around power management for the serial-engine driver as well as probing the LLCC driver using custom hardware descriptions inside of the device itself. - Added support for the Samsung thermal management unit - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy APIs and allow multiple PMC instances everywhere. - Updates to the TI SCI and KNAS drivers to improve suspend/resume support. - Minor driver changes for mediatek, xilinx, allwinner, aspeed, tegra, broadcom, amd, microchip and starfive specific drivers - Memory controller updates for Tegra and Renesas for additional SoC types and other improvements. - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to update driver probing, object lifetimes and address minor bugs" * tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits) Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface" Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers" memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate() memory: tegra264: drop redundant tegra264_mc_icc_aggregate() memory: tegra186-emc: stop borrowing MC aggregate hook for EMC soc: aspeed: cleanup dead default for ASPEED_SOCINFO firmware: tegra: bpmp: Add support for multi-socket platforms firmware: tegra: bpmp: Propagate debugfs errors soc/tegra: pmc: Add Tegra238 support soc/tegra: pmc: Restrict power-off handler to Nexus 7 soc/tegra: pmc: Populate powergate debugfs only when needed soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard soc/tegra: pmc: Remove unused legacy functions soc/tegra: pmc: Create PMC context dynamically firmware: samsung: acpm: remove compile-testing stubs firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper firmware: samsung: acpm: Add TMU protocol support firmware: samsung: acpm: Make acpm_ops const and access via pointer firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr ... 
Pull SoC driver updates from Arnd Bergmann:
 "There are a few added drivers, but mostly the normal maintenance to
  drivers for firmware, memory controller and other soc specific
  hardware:

   - The NXP QuickEngine gets modern MSI support, which allows some
     cleanups to the GICv3 irqchip chip driver

   - A new SoC specific driver for the Renesas R-Car MFIS unit is added,
     encapsulating support for the on-chip mailbox and hwspinlock
     implementations that are not easily separated into individual
     drivers

   - The Qualcomm SoC drivers add support for additional SoC
     implementations, and flexibility around power management for the
     serial-engine driver as well as probing the LLCC driver using
     custom hardware descriptions inside of the device itself.

   - Added support for the Samsung thermal management unit

   - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
     APIs and allow multiple PMC instances everywhere.

   - Updates to the TI SCI and KNAS drivers to improve suspend/resume
     support.

   - Minor driver changes for mediatek, xilinx, allwinner, aspeed,
     tegra, broadcom, amd, microchip and starfive specific drivers

   - Memory controller updates for Tegra and Renesas for additional SoC
     types and other improvements.

   - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to
     update driver probing, object lifetimes and address minor bugs"

* tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits)
  Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
  Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
  memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate()
  memory: tegra264: drop redundant tegra264_mc_icc_aggregate()
  memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
  soc: aspeed: cleanup dead default for ASPEED_SOCINFO
  firmware: tegra: bpmp: Add support for multi-socket platforms
  firmware: tegra: bpmp: Propagate debugfs errors
  soc/tegra: pmc: Add Tegra238 support
  soc/tegra: pmc: Restrict power-off handler to Nexus 7
  soc/tegra: pmc: Populate powergate debugfs only when needed
  soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
  soc/tegra: pmc: Remove unused legacy functions
  soc/tegra: pmc: Create PMC context dynamically
  firmware: samsung: acpm: remove compile-testing stubs
  firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
  firmware: samsung: acpm: Add TMU protocol support
  firmware: samsung: acpm: Make acpm_ops const and access via pointer
  firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
  firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
  ...
mfd: rz-mtu3: Make reset optional 2026-06-17T10:33:08+00:00 Cosmin Tanislav cosmin-gabriel.tanislav.xa@renesas.com 2026-05-27T14:56:06+00:00 f6b692d1f466ba3837ae9478e0d5ce6ef77697b4 The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs do not have a reset line for the MTU3 block. Prepare for them by making it optional. Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260527145606.136536-5-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones <lee@kernel.org> 
The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs do not have a
reset line for the MTU3 block.

Prepare for them by making it optional.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-5-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: rz-mtu3: Store &pdev->dev in local variable 2026-06-17T10:33:05+00:00 Cosmin Tanislav cosmin-gabriel.tanislav.xa@renesas.com 2026-05-27T14:56:05+00:00 a3bd9f3dd5c88c621e4bc4ecd5f2ae9c277f558a &pdev->dev is accessed multiple times during probe. Store it in a local variable and use that to simplify the code. Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260527145606.136536-4-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones <lee@kernel.org> 
&pdev->dev is accessed multiple times during probe. Store it in a local
variable and use that to simplify the code.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-4-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: rz-mtu3: Use local variable for reset 2026-06-17T10:33:03+00:00 Cosmin Tanislav cosmin-gabriel.tanislav.xa@renesas.com 2026-05-27T14:56:04+00:00 4bf15cafe9588d0c303143b4c64c7bfc7b1a3a5d Remove struct rz_mtu3_priv::rstc and use a local variable for it as it is not needed outside of rz_mtu3_probe() anymore. Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260527145606.136536-3-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones <lee@kernel.org> 
Remove struct rz_mtu3_priv::rstc and use a local variable for it as it
is not needed outside of rz_mtu3_probe() anymore.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-3-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: rz-mtu3: Use device-managed APIs 2026-06-17T10:33:00+00:00 Cosmin Tanislav cosmin-gabriel.tanislav.xa@renesas.com 2026-05-27T14:56:03+00:00 ed1a370da26369a26b25901685e620c12040a471 Replace devm_reset_control_get_exclusive() and the manual reset_control_deassert()/reset_control_assert() with handling by devm_reset_control_get_exclusive_deasserted(). Replace mfd_add_devices()/mfd_remove_devices() with devm_mfd_add_devices(). Remove the custom cleanup action. Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260527145606.136536-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones <lee@kernel.org> 
Replace devm_reset_control_get_exclusive() and the manual
reset_control_deassert()/reset_control_assert() with handling by
devm_reset_control_get_exclusive_deasserted().

Replace mfd_add_devices()/mfd_remove_devices() with
devm_mfd_add_devices().

Remove the custom cleanup action.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-2-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>