linux-stable.git/drivers/mfd, branch v7.2.6 Linux kernel stable tree mfd: cs42l43: Fix regmap defaults ordering 2026-09-14T11:40:42+00:00 Charles Keepax ckeepax@opensource.cirrus.com 2026-08-05T12:01:09+00:00 43ba7cdff6dd48a3c7a8175d6e6afeb07bc5a6f6 [ Upstream commit 9d0e4b1ae5b045a2c92b0b9a1c3b268191c219d9 ] The regmap defaults should be ordered as binary search is done on the array. A few registers were added in the wrong places, move these to be in register address order. Fixes: a6fe20d67dc7 ("mfd: cs42l43: Add support for the B variant") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805120109.4024451-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 9d0e4b1ae5b045a2c92b0b9a1c3b268191c219d9 ]

The regmap defaults should be ordered as binary search is done on the
array. A few registers were added in the wrong places, move these to be
in register address order.

Fixes: a6fe20d67dc7 ("mfd: cs42l43: Add support for the B variant")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260805120109.4024451-1-ckeepax@opensource.cirrus.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: macsmc: Fix key count endianness annotation 2026-09-14T11:40:25+00:00 Sven Peter sven@kernel.org 2026-07-19T13:00:32+00:00 ad50c2c550ff20ac76461c95f22c5b23b4205e6c [ Upstream commit 0a29aa605286bcd01632eb6b61f59b9053312347 ] SMC firmware returns the value of the #KEY key in big-endian unlike most other keys. Reading it through apple_smc_read_u32() into a plain u32 and then converting with be32_to_cpu() makes sparse complain: drivers/mfd/macsmc.c:462:26: sparse: cast to restricted __be32 Read the raw value into a __be32 using apple_smc_read() instead. Fixes: e038d985c982 ("mfd: Add Apple Silicon System Management Controller") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607181046.OANjIoqR-lkp@intel.com/ Signed-off-by: Sven Peter <sven@kernel.org> Reviewed-by: Janne Grunau <j@jannau.net> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260719-b4-macsmc-be32-fix-v1-1-c7b1936307fa@kernel.org Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 0a29aa605286bcd01632eb6b61f59b9053312347 ]

SMC firmware returns the value of the #KEY key in big-endian unlike most
other keys. Reading it through apple_smc_read_u32() into a plain u32
and then converting with be32_to_cpu() makes sparse complain:

  drivers/mfd/macsmc.c:462:26: sparse: cast to restricted __be32

Read the raw value into a __be32 using apple_smc_read() instead.

Fixes: e038d985c982 ("mfd: Add Apple Silicon System Management Controller")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607181046.OANjIoqR-lkp@intel.com/
Signed-off-by: Sven Peter <sven@kernel.org>
Reviewed-by: Janne Grunau <j@jannau.net>
Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com>
Link: https://patch.msgid.link/20260719-b4-macsmc-be32-fix-v1-1-c7b1936307fa@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: iqs62x: Reject zero-length firmware records 2026-09-14T11:40:24+00:00 Pengpeng Hou pengpeng@iscas.ac.cn 2026-07-20T11:54:23+00:00 e54c7a2bce63d704f848af9c843c3d860e7c9d57 [ Upstream commit 08ea045e0b82cbcadb7a2efc43a23561489a00f2 ] struct iqs62x_fw_rec includes the first data byte in its fixed-size header, so the parser advances by len - 1 bytes after that header. A zero len makes the size_t cursor update move back by one byte, so the next record overlaps the current record instead of following a valid declared extent. Reject zero-length records and express the remaining-size check without an offset addition. Fixes: 4d9cf7df8d35 ("mfd: Add support for Azoteq IQS620A/621/622/624/625") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/all/20260706091034.75865-1-pengpeng@iscas.ac.cn/ Link: https://patch.msgid.link/20260720115423.94994-1-pengpeng@iscas.ac.cn Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 08ea045e0b82cbcadb7a2efc43a23561489a00f2 ]

struct iqs62x_fw_rec includes the first data byte in its fixed-size header,
so the parser advances by len - 1 bytes after that header. A zero len makes
the size_t cursor update move back by one byte, so the next record overlaps
the current record instead of following a valid declared extent.

Reject zero-length records and express the remaining-size check without an
offset addition.

Fixes: 4d9cf7df8d35 ("mfd: Add support for Azoteq IQS620A/621/622/624/625")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/all/20260706091034.75865-1-pengpeng@iscas.ac.cn/
Link: https://patch.msgid.link/20260720115423.94994-1-pengpeng@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: rave-sp: validate received frame payload lengths 2026-09-14T11:40:24+00:00 Pengpeng Hou pengpeng@iscas.ac.cn 2026-07-20T11:55:23+00:00 15327f1eb9cc97bac22b2717188d9c2b67098f73 [ Upstream commit 0be718b5451bd83865d6e2a8d750ca7886c4772a ] A received RAVE-SP frame contains protocol data followed by a variant-specific one- or two-byte checksum. rave_sp_receive_frame() derives a checksum pointer before proving that the frame contains the checksum, then passes the checksum-inclusive length to handlers that index the command, acknowledgment ID and event-data bytes or derive a reply payload length. Name those protocol field offsets, prove the checksum extent before deriving the protocol-data length, pass only that data length to the handlers, and require the complete event or reply prefix before consuming it. Fixes: 538ee27290fa ("mfd: Add driver for RAVE Supervisory Processor") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/all/20260706092337.78754-1-pengpeng@iscas.ac.cn/ Link: https://patch.msgid.link/20260720115523.99956-1-pengpeng@iscas.ac.cn Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 0be718b5451bd83865d6e2a8d750ca7886c4772a ]

A received RAVE-SP frame contains protocol data followed by a
variant-specific one- or two-byte checksum. rave_sp_receive_frame() derives
a checksum pointer before proving that the frame contains the checksum,
then passes the checksum-inclusive length to handlers that index the
command, acknowledgment ID and event-data bytes or derive a reply payload
length.

Name those protocol field offsets, prove the checksum extent before
deriving the protocol-data length, pass only that data length to the
handlers, and require the complete event or reply prefix before consuming
it.

Fixes: 538ee27290fa ("mfd: Add driver for RAVE Supervisory Processor")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/all/20260706092337.78754-1-pengpeng@iscas.ac.cn/
Link: https://patch.msgid.link/20260720115523.99956-1-pengpeng@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: sm501: Fix potential memory leaks during remove 2026-09-07T15:37:21+00:00 Abdun Nihaal nihaal@cse.iitm.ac.in 2026-07-20T11:38:32+00:00 c8be3a076a59ec793fb2e4bdb830a709aaea9cce commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d upstream. The memory allocated for struct sm501_devdata in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to kfree(). Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d upstream.

The memory allocated for struct sm501_devdata in sm501_pci_probe() and
sm501_plat_probe() is not freed by the corresponding remove functions
sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to
kfree().

Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: qnap-mcu: keep the reply buffer alive past a command timeout 2026-09-07T15:37:21+00:00 Ali Ahmet Memis ali@iusegentoo.com 2026-08-02T13:53:07+00:00 8391ee06d08845a0a165b5fe679ba326915166b2 commit 47504742cea7878ebd1bf1491bbed923df6b90b1 upstream. qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]; ... reply->data = rx; reply->length = length; and qnap_mcu_receive_buf() writes into it from the serdev receive path, which runs out of flush_to_ldisc() and is not serialized against qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec() holds that mutex across wait_for_completion_timeout(). On a timeout qnap_mcu_exec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnap_mcu_write() fails, since that path returns without touching the reply state either. Move the receive buffer into struct qnap_mcu. It is 37 bytes and the structure is devm_kzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. bus_lock keeps commands from sharing it. This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both after its if (!reply->length) return size; check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnap_mcu_exec() has already checked against sizeof(mcu->rx). Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/ Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 47504742cea7878ebd1bf1491bbed923df6b90b1 upstream.

qnap_mcu_exec() publishes an on-stack buffer to the receive path:

	unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE];
	...
	reply->data = rx;
	reply->length = length;

and qnap_mcu_receive_buf() writes into it from the serdev receive path,
which runs out of flush_to_ldisc() and is not serialized against
qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec()
holds that mutex across wait_for_completion_timeout().

On a timeout qnap_mcu_exec() returns with reply->data still pointing at
its own frame. A reply that arrives late, or an unsolicited message from
the MCU, is then written into a stack frame that has been left, corrupting
whatever runs next on that stack. The same applies when qnap_mcu_write()
fails, since that path returns without touching the reply state either.

Move the receive buffer into struct qnap_mcu. It is 37 bytes and the
structure is devm_kzalloc()ed, so it lives as long as the driver, and a
late write lands in memory that is still valid and is reinitialized by the
next command. bus_lock keeps commands from sharing it.

This deliberately does not clear reply->data or reply->length on the
timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both
after its

	if (!reply->length)
		return size;

check: clearing reply->data gives a NULL dereference, and clearing
reply->length alone removes the reply->received == reply->length exit
condition, so the copy loop runs until the uart chunk is consumed and
overruns the buffer. Leaving both set keeps the write bounded by
reply->length, which qnap_mcu_exec() has already checked against
sizeof(mcu->rx).

Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/
Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mfd: cgbc: Fix teardown ordering in cgbc_remove() 2026-09-07T15:37:21+00:00 Thomas Richard thomas.richard@bootlin.com 2026-07-13T14:43:43+00:00 3266537d0333a6a43fa07fdb1320ed61d6753c66 commit 2970c2db8ab3d97ea6250c14ca49b1e1731115ab upstream. Release Board Controller session once children are removed by the core. Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/cover.1783507945.git.u.kleine-koenig%40baylibre.com?part=19 Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver") Signed-off-by: Thomas Richard <thomas.richard@bootlin.com> Link: https://patch.msgid.link/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a@bootlin.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2970c2db8ab3d97ea6250c14ca49b1e1731115ab upstream.

Release Board Controller session once children are removed by the core.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1783507945.git.u.kleine-koenig%40baylibre.com?part=19
Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver")
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03T05:38:17+00:00 Uwe Kleine-König (The Capable Hub) u.kleine-koenig@baylibre.com 2026-06-30T09:24:36+00:00 995832b2cebe6969d1b42635db698803ee31294d Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> 
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Merge tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd 2026-06-18T21:26:29+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-18T21:26:29+00:00 6beaec3aee9852438b89e4d7891caf5e84d45851 Pull MFD updates from Lee Jones: "New Support & Features: - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger, MUIC, flash and RGB LED controllers - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip - Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager Improvements & Fixes: - Core: Unify the user-visible company name to "Qualcomm" across various config options - ChromeOS EC: - Delay `dev_set_drvdata()` until the probe process has successfully completed to avoid use-after-free issues - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already defined in Device Tree or ACPI - Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds memory access during firmware loading - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to support board files requesting GPIOs - Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC - Renesas RSMU: Fix page register setup for the 8A3400x family by correctly calculating the page address - Renesas RZ/MTU3: - Make the reset line optional to support newer SoC variants (RZ/T2H, RZ/N2H) - Modernize the driver by using device-managed APIs for reset control and device addition - Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress unnecessary "DMA mask not set" messages - Silicon Motion SM501: Fix a reference leak on failed device registration by properly dropping the platform device reference - Texas Instruments: - TPS65219: Make poweroff handler registration conditional on the "system-power-controller" Device Tree property - TPS6586x: Fix Device Tree node reference counting by manually bumping the refcount for sub-devices - TPS65910: Add return value checking for the dummy I2C transfer used to work around silicon erratum SWCZ010 - TWL4030: Update board-specific checks to use Device Tree compatibles instead of legacy machine IDs Cleanups & Refactoring: - Core: Consistently define `pci_device_id` arrays using named initializers across various Intel and Silicon Motion drivers - Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik - Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro comments - MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()` as returning a boolean status - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity - Silicon Labs Si476x: Fix various spelling mistakes in driver comments - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell tables for each PMIC model - Timberdale: Move GPIO pin definitions into the driver and transition to using a software node for the GPIO cell - Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member Device Tree Binding Updates: - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin controllers - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema - Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU - MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for the MT6359 variant - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks - Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible string due to documentation errors - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC, flash and RGB LEDs) - Spreadtrum SC2731: Include regulator bindings for the SC2730 variant - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the PWM subnode - Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792 variant Removals: - Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX phones" * tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits) dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode mfd: rz-mtu3: Make reset optional mfd: rz-mtu3: Store &pdev->dev in local variable mfd: rz-mtu3: Use local variable for reset mfd: rz-mtu3: Use device-managed APIs dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl mfd: tps6586x: Fix OF node refcount dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings mfd: twl4030-power: Update checks for specific boards to use the DT dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block mfd: qcom_rpm: Add msm8960 QDSS clock resource mfd: si476x-i2c: Fix spelling mistakes in comments mfd: max77620: Convert poweroff support to sys-off API mfd: dt-bindings: mt6397: Add regulator supplies dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359 mfd: cs42l43: Sanity check firmware size mfd: qcom: Unify user-visible "Qualcomm" name mfd: cros_ec: Delay dev_set_drvdata() until probe success ... 
Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
     includes charger, MUIC, flash and RGB LED controllers
   - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
   - Texas Instruments BQ25792: Add support for the TI BQ25792 charger
     manager

  Improvements & Fixes:
   - Core: Unify the user-visible company name to "Qualcomm" across
     various config options
   - ChromeOS EC:
       - Delay `dev_set_drvdata()` until the probe process has
         successfully completed to avoid use-after-free issues
       - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is
         already defined in Device Tree or ACPI
   - Cirrus Logic CS42L43: Add a sanity check for firmware size to
     prevent out-of-bounds memory access during firmware loading
   - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated
     software node to support board files requesting GPIOs
   - Maxim MAX77620: Modernize poweroff handling by converting to the
     sys-off API
   - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960
     SoC
   - Renesas RSMU: Fix page register setup for the 8A3400x family by
     correctly calculating the page address
   - Renesas RZ/MTU3:
       - Make the reset line optional to support newer SoC variants
         (RZ/T2H, RZ/N2H)
       - Modernize the driver by using device-managed APIs for reset
         control and device addition
   - Samsung Core: Set the coherent DMA mask to zero for the Samsung
     PMIC device to suppress unnecessary "DMA mask not set" messages
   - Silicon Motion SM501: Fix a reference leak on failed device
     registration by properly dropping the platform device reference
   - Texas Instruments:
       - TPS65219: Make poweroff handler registration conditional on the
         "system-power-controller" Device Tree property
       - TPS6586x: Fix Device Tree node reference counting by manually
         bumping the refcount for sub-devices
       - TPS65910: Add return value checking for the dummy I2C transfer
         used to work around silicon erratum SWCZ010
       - TWL4030: Update board-specific checks to use Device Tree
         compatibles instead of legacy machine IDs

  Cleanups & Refactoring:
   - Core: Consistently define `pci_device_id` arrays using named
     initializers across various Intel and Silicon Motion drivers
   - Maintainers: Shift maintenance of Samsung PMIC drivers to André
     Draszik
   - Maxim MAX77759: Improve code style by reformatting the IRQ table
     and refining macro comments
   - MEN MENF21BMC / Texas Instruments TWL: Correctly treat
     `i2c_check_functionality()` as returning a boolean status
   - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code
     clarity
   - Silicon Labs Si476x: Fix various spelling mistakes in driver
     comments
   - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and
     separate MFD cell tables for each PMIC model
   - Timberdale: Move GPIO pin definitions into the driver and
     transition to using a software node for the GPIO cell
   - Wolfson WM8994: Remove dead legacy-GPIO code and its associated
     `irq_gpio` member

  Device Tree Binding Updates:
   - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its
     SoC0/SoC1 pin controllers
   - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format
     to YAML DT schema
   - Khadas MCU: Add a new compatible and fan-supply property for the
     Khadas VIM4 MCU
   - MediaTek MT6397: Add support for the MT6365 PMIC and document
     regulator supplies for the MT6359 variant
   - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
   - Renesas RZ/G3L: Revert the addition of the
     `renesas,r9a08g046-lvds-cmn` compatible string due to documentation
     errors
   - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices
     (charger, MUIC, flash and RGB LEDs)
   - Spreadtrum SC2731: Include regulator bindings for the SC2730
     variant
   - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as
     required for the PWM subnode
   - Texas Instruments BQ257xx: Expand the BQ25703A binding to include
     the BQ25792 variant

  Removals:
   - Motorola EZX PCAP: Remove the unused and non-functional driver for
     Motorola EZX phones"

* tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
  dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
  dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
  mfd: rz-mtu3: Make reset optional
  mfd: rz-mtu3: Store &pdev->dev in local variable
  mfd: rz-mtu3: Use local variable for reset
  mfd: rz-mtu3: Use device-managed APIs
  dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
  mfd: tps6586x: Fix OF node refcount
  dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
  mfd: twl4030-power: Update checks for specific boards to use the DT
  dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
  mfd: qcom_rpm: Add msm8960 QDSS clock resource
  mfd: si476x-i2c: Fix spelling mistakes in comments
  mfd: max77620: Convert poweroff support to sys-off API
  mfd: dt-bindings: mt6397: Add regulator supplies
  dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
  dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
  mfd: cs42l43: Sanity check firmware size
  mfd: qcom: Unify user-visible "Qualcomm" name
  mfd: cros_ec: Delay dev_set_drvdata() until probe success
  ...
Merge tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc 2026-06-17T18:21:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-17T18:21:40+00:00 70cb95c736807da2c4952423c9f9afe470341996 Pull SoC driver updates from Arnd Bergmann: "There are a few added drivers, but mostly the normal maintenance to drivers for firmware, memory controller and other soc specific hardware: - The NXP QuickEngine gets modern MSI support, which allows some cleanups to the GICv3 irqchip chip driver - A new SoC specific driver for the Renesas R-Car MFIS unit is added, encapsulating support for the on-chip mailbox and hwspinlock implementations that are not easily separated into individual drivers - The Qualcomm SoC drivers add support for additional SoC implementations, and flexibility around power management for the serial-engine driver as well as probing the LLCC driver using custom hardware descriptions inside of the device itself. - Added support for the Samsung thermal management unit - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy APIs and allow multiple PMC instances everywhere. - Updates to the TI SCI and KNAS drivers to improve suspend/resume support. - Minor driver changes for mediatek, xilinx, allwinner, aspeed, tegra, broadcom, amd, microchip and starfive specific drivers - Memory controller updates for Tegra and Renesas for additional SoC types and other improvements. - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to update driver probing, object lifetimes and address minor bugs" * tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits) Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface" Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers" memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate() memory: tegra264: drop redundant tegra264_mc_icc_aggregate() memory: tegra186-emc: stop borrowing MC aggregate hook for EMC soc: aspeed: cleanup dead default for ASPEED_SOCINFO firmware: tegra: bpmp: Add support for multi-socket platforms firmware: tegra: bpmp: Propagate debugfs errors soc/tegra: pmc: Add Tegra238 support soc/tegra: pmc: Restrict power-off handler to Nexus 7 soc/tegra: pmc: Populate powergate debugfs only when needed soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard soc/tegra: pmc: Remove unused legacy functions soc/tegra: pmc: Create PMC context dynamically firmware: samsung: acpm: remove compile-testing stubs firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper firmware: samsung: acpm: Add TMU protocol support firmware: samsung: acpm: Make acpm_ops const and access via pointer firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr ... 
Pull SoC driver updates from Arnd Bergmann:
 "There are a few added drivers, but mostly the normal maintenance to
  drivers for firmware, memory controller and other soc specific
  hardware:

   - The NXP QuickEngine gets modern MSI support, which allows some
     cleanups to the GICv3 irqchip chip driver

   - A new SoC specific driver for the Renesas R-Car MFIS unit is added,
     encapsulating support for the on-chip mailbox and hwspinlock
     implementations that are not easily separated into individual
     drivers

   - The Qualcomm SoC drivers add support for additional SoC
     implementations, and flexibility around power management for the
     serial-engine driver as well as probing the LLCC driver using
     custom hardware descriptions inside of the device itself.

   - Added support for the Samsung thermal management unit

   - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
     APIs and allow multiple PMC instances everywhere.

   - Updates to the TI SCI and KNAS drivers to improve suspend/resume
     support.

   - Minor driver changes for mediatek, xilinx, allwinner, aspeed,
     tegra, broadcom, amd, microchip and starfive specific drivers

   - Memory controller updates for Tegra and Renesas for additional SoC
     types and other improvements.

   - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to
     update driver probing, object lifetimes and address minor bugs"

* tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits)
  Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
  Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
  memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate()
  memory: tegra264: drop redundant tegra264_mc_icc_aggregate()
  memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
  soc: aspeed: cleanup dead default for ASPEED_SOCINFO
  firmware: tegra: bpmp: Add support for multi-socket platforms
  firmware: tegra: bpmp: Propagate debugfs errors
  soc/tegra: pmc: Add Tegra238 support
  soc/tegra: pmc: Restrict power-off handler to Nexus 7
  soc/tegra: pmc: Populate powergate debugfs only when needed
  soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
  soc/tegra: pmc: Remove unused legacy functions
  soc/tegra: pmc: Create PMC context dynamically
  firmware: samsung: acpm: remove compile-testing stubs
  firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
  firmware: samsung: acpm: Add TMU protocol support
  firmware: samsung: acpm: Make acpm_ops const and access via pointer
  firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
  firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
  ...