linux-stable.git/drivers/of, branch v7.0.4 Linux kernel stable tree of: unittest: fix use-after-free in testdrv_probe() 2026-05-07T04:13:46+00:00 Wentao Liang vulab@iscas.ac.cn 2026-04-09T03:48:59+00:00 6b2023286d2c6ed3bf964fb92e34c9c14d42eb69 commit 07fd339b2c253205794bea5d9b4b7548a4546c56 upstream. The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the reference count drops to zero. Later, the same freed pointer 'dn' is passed to of_platform_default_populate(), leading to a use-after-free. The reference to pdev->dev.of_node is owned by the device model and should not be released by the driver. Remove the erroneous of_node_put() to prevent premature freeing. Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 07fd339b2c253205794bea5d9b4b7548a4546c56 upstream.

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.

Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
of: unittest: fix use-after-free in of_unittest_changeset() 2026-05-07T04:13:46+00:00 Wentao Liang vulab@iscas.ac.cn 2026-04-09T02:22:33+00:00 6fdad20b7975bdc32e85b45f8f7c640f6687b81f commit faecdd423c27f0d6090156a435ba9dbbac0eaddb upstream. The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct device_node. The call to of_node_put(nchangeset) can decrement the reference count to zero and free the node if there are no other holders. After that, the code still uses 'parent' to check for the presence of a property and to read a string property, leading to a use-after-free. Fix this by moving the of_node_put() call after the last access to 'parent', avoiding the UAF. Fixes: 1c668ea65506 ("of: unittest: Use of_property_present()") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260409022233.418103-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit faecdd423c27f0d6090156a435ba9dbbac0eaddb upstream.

The variable 'parent' is assigned the value of 'nchangeset' earlier in the
function, meaning both point to the same struct device_node. The call to
of_node_put(nchangeset) can decrement the reference count to zero and
free the node if there are no other holders. After that, the code still
uses 'parent' to check for the presence of a property and to read a
string property, leading to a use-after-free.

Fix this by moving the of_node_put() call after the last access to
'parent', avoiding the UAF.

Fixes: 1c668ea65506 ("of: unittest: Use of_property_present()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409022233.418103-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
device property: Make modifications of fwnode "flags" thread safe 2026-05-07T04:13:43+00:00 Douglas Anderson dianders@chromium.org 2026-03-17T16:01:20+00:00 bed1721fb33c4bb326242a3f316d45862466f08d commit f72e77c33e4b5657af35125e75bab249256030f3 upstream. In various places in the kernel, we modify the fwnode "flags" member by doing either: fwnode->flags |= SOME_FLAG; fwnode->flags &= ~SOME_FLAG; This type of modification is not thread-safe. If two threads are both mucking with the flags at the same time then one can clobber the other. While flags are often modified while under the "fwnode_link_lock", this is not universally true. Create some accessor functions for setting, clearing, and testing the FWNODE flags and move all users to these accessor functions. New accessor functions use set_bit() and clear_bit(), which are thread-safe. Cc: stable@vger.kernel.org Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()") Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Mark Brown <broonie@kernel.org> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Saravana Kannan <saravanak@kernel.org> Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d21b1d15a2e38@changeid [ Fix fwnode_clear_flag() argument alignment, restore dropped blank line in fwnode_dev_initialized(), and remove unnecessary parentheses around fwnode_test_flag() calls. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f72e77c33e4b5657af35125e75bab249256030f3 upstream.

In various places in the kernel, we modify the fwnode "flags" member
by doing either:
  fwnode->flags |= SOME_FLAG;
  fwnode->flags &= ~SOME_FLAG;

This type of modification is not thread-safe. If two threads are both
mucking with the flags at the same time then one can clobber the
other.

While flags are often modified while under the "fwnode_link_lock",
this is not universally true.

Create some accessor functions for setting, clearing, and testing the
FWNODE flags and move all users to these accessor functions. New
accessor functions use set_bit() and clear_bit(), which are
thread-safe.

Cc: stable@vger.kernel.org
Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Saravana Kannan <saravanak@kernel.org>
Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d21b1d15a2e38@changeid
[ Fix fwnode_clear_flag() argument alignment, restore dropped blank
  line in fwnode_dev_initialized(), and remove unnecessary parentheses
  around fwnode_test_flag() calls. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 2026-02-12T20:13:01+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-12T20:13:01+00:00 136114e0abf03005e182d75761ab694648e6d388 Pull non-MM updates from Andrew Morton: - "ocfs2: give ocfs2 the ability to reclaim suballocator free bg" saves disk space by teaching ocfs2 to reclaim suballocator block group space (Heming Zhao) - "Add ARRAY_END(), and use it to fix off-by-one bugs" adds the ARRAY_END() macro and uses it in various places (Alejandro Colomar) - "vmcoreinfo: support VMCOREINFO_BYTES larger than PAGE_SIZE" makes the vmcore code future-safe, if VMCOREINFO_BYTES ever exceeds the page size (Pnina Feder) - "kallsyms: Prevent invalid access when showing module buildid" cleans up kallsyms code related to module buildid and fixes an invalid access crash when printing backtraces (Petr Mladek) - "Address page fault in ima_restore_measurement_list()" fixes a kexec-related crash that can occur when booting the second-stage kernel on x86 (Harshit Mogalapalli) - "kho: ABI headers and Documentation updates" updates the kexec handover ABI documentation (Mike Rapoport) - "Align atomic storage" adds the __aligned attribute to atomic_t and atomic64_t definitions to get natural alignment of both types on csky, m68k, microblaze, nios2, openrisc and sh (Finn Thain) - "kho: clean up page initialization logic" simplifies the page initialization logic in kho_restore_page() (Pratyush Yadav) - "Unload linux/kernel.h" moves several things out of kernel.h and into more appropriate places (Yury Norov) - "don't abuse task_struct.group_leader" removes the usage of ->group_leader when it is "obviously unnecessary" (Oleg Nesterov) - "list private v2 & luo flb" adds some infrastructure improvements to the live update orchestrator (Pasha Tatashin) * tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (107 commits) watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency procfs: fix missing RCU protection when reading real_parent in do_task_stat() watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() kcsan, compiler_types: avoid duplicate type issues in BPF Type Format kho: fix doc for kho_restore_pages() tests/liveupdate: add in-kernel liveupdate test liveupdate: luo_flb: introduce File-Lifecycle-Bound global state liveupdate: luo_file: Use private list list: add kunit test for private list primitives list: add primitives for private list manipulations delayacct: fix uapi timespec64 definition panic: add panic_force_cpu= parameter to redirect panic to a specific CPU netclassid: use thread_group_leader(p) in update_classid_task() RDMA/umem: don't abuse current->group_leader drm/pan*: don't abuse current->group_leader drm/amd: kill the outdated "Only the pthreads threading model is supported" checks drm/amdgpu: don't abuse current->group_leader android/binder: use same_thread_group(proc->tsk, current) in binder_mmap() android/binder: don't abuse current->group_leader kho: skip memoryless NUMA nodes when reserving scratch areas ... 
Pull non-MM updates from Andrew Morton:

 - "ocfs2: give ocfs2 the ability to reclaim suballocator free bg" saves
   disk space by teaching ocfs2 to reclaim suballocator block group
   space (Heming Zhao)

 - "Add ARRAY_END(), and use it to fix off-by-one bugs" adds the
   ARRAY_END() macro and uses it in various places (Alejandro Colomar)

 - "vmcoreinfo: support VMCOREINFO_BYTES larger than PAGE_SIZE" makes
   the vmcore code future-safe, if VMCOREINFO_BYTES ever exceeds the
   page size (Pnina Feder)

 - "kallsyms: Prevent invalid access when showing module buildid" cleans
   up kallsyms code related to module buildid and fixes an invalid
   access crash when printing backtraces (Petr Mladek)

 - "Address page fault in ima_restore_measurement_list()" fixes a
   kexec-related crash that can occur when booting the second-stage
   kernel on x86 (Harshit Mogalapalli)

 - "kho: ABI headers and Documentation updates" updates the kexec
   handover ABI documentation (Mike Rapoport)

 - "Align atomic storage" adds the __aligned attribute to atomic_t and
   atomic64_t definitions to get natural alignment of both types on
   csky, m68k, microblaze, nios2, openrisc and sh (Finn Thain)

 - "kho: clean up page initialization logic" simplifies the page
   initialization logic in kho_restore_page() (Pratyush Yadav)

 - "Unload linux/kernel.h" moves several things out of kernel.h and into
   more appropriate places (Yury Norov)

 - "don't abuse task_struct.group_leader" removes the usage of
   ->group_leader when it is "obviously unnecessary" (Oleg Nesterov)

 - "list private v2 & luo flb" adds some infrastructure improvements to
   the live update orchestrator (Pasha Tatashin)

* tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (107 commits)
  watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency
  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
  kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
  kho: fix doc for kho_restore_pages()
  tests/liveupdate: add in-kernel liveupdate test
  liveupdate: luo_flb: introduce File-Lifecycle-Bound global state
  liveupdate: luo_file: Use private list
  list: add kunit test for private list primitives
  list: add primitives for private list manipulations
  delayacct: fix uapi timespec64 definition
  panic: add panic_force_cpu= parameter to redirect panic to a specific CPU
  netclassid: use thread_group_leader(p) in update_classid_task()
  RDMA/umem: don't abuse current->group_leader
  drm/pan*: don't abuse current->group_leader
  drm/amd: kill the outdated "Only the pthreads threading model is supported" checks
  drm/amdgpu: don't abuse current->group_leader
  android/binder: use same_thread_group(proc->tsk, current) in binder_mmap()
  android/binder: don't abuse current->group_leader
  kho: skip memoryless NUMA nodes when reserving scratch areas
  ...
Merge tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux 2026-02-12T02:27:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-12T02:27:08+00:00 098b6e44cbaa2d526d06af90c862d13fb414a0ec Pull devicetree updates from Rob Herring: "DT core: - Sync dtc/libfdt with upstream v1.7.2-62-ga26ef6400bd8 - Add a for_each_compatible_node_scoped() loop and convert users in cpufreq, dmaengine, clk, cdx, powerpc and Arm - Simplify of/platform.c with scoped loop helpers - Add fw_devlink tracking for "mmc-pwrseq" - Optimize fw_devlink callback code size for pinctrl-N properties - Replace strcmp_suffix() with strends() DT bindings: - Support building single binding targets - Convert google,goldfish-fb, cznic,turris-mox-rwtm, ti,prm-inst - Add bindings for Freescale AVIC, Realtek RTD1xxx system controllers, Microchip 25AA010A EEPROM, OnSemi FIN3385, IEI WT61P803 PUZZLE, Delta Electronics DPS-800-AB power supply, Infineon IR35221 Digital Multi-phase Controller, Infineon PXE1610 Digital Dual Output 6+1 VR12.5 & VR13 CPU Controller, socionext,uniphier-smpctrl, and xlnx,zynqmp-firmware - Lots of trivial binding fixes to address warnings in DTS files. These are mostly for arm64 platforms which is getting closer to be warning free. Some public shaming has helped. - Fix I2C bus node names in examples - Drop obsolete brcm,vulcan-soc binding - Drop unreferenced binding headers" * tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (60 commits) dt-bindings: interrupt-controller: Add compatiblie string fsl,imx(1|25|27|31|35)-avic dt-bindings: soc: imx: add fsl,aips and fsl,emi compatible strings dt-bindings: display: bridge: lt8912b: Drop reset gpio requirement dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated cpufreq: s5pv210: Simplify with scoped for each OF child loop dmaengine: fsl_raid: Simplify with scoped for each OF child loop clk: imx: imx31: Simplify with scoped for each OF child loop clk: imx: imx27: Simplify with scoped for each OF child loop cdx: Use mutex guard to simplify error handling cdx: Simplify with scoped for each OF child loop powerpc/wii: Simplify with scoped for each OF child loop powerpc/fsp2: Simplify with scoped for each OF child loop ARM: exynos: Simplify with scoped for each OF child loop ARM: at91: Simplify with scoped for each OF child loop of: Add for_each_compatible_node_scoped() helper dt-bindings: Fix emails with spaces or missing brackets scripts/dtc: Update to upstream version v1.7.2-62-ga26ef6400bd8 dt-bindings: crypto: inside-secure,safexcel: Mandate only ring IRQs dt-bindings: crypto: inside-secure,safexcel: Add SoC compatibles of: reserved_mem: Fix placement of __free() annotation ... 
Pull devicetree updates from Rob Herring:
 "DT core:

   - Sync dtc/libfdt with upstream v1.7.2-62-ga26ef6400bd8

   - Add a for_each_compatible_node_scoped() loop and convert users in
     cpufreq, dmaengine, clk, cdx, powerpc and Arm

   - Simplify of/platform.c with scoped loop helpers

   - Add fw_devlink tracking for "mmc-pwrseq"

   - Optimize fw_devlink callback code size for pinctrl-N properties

   - Replace strcmp_suffix() with strends()

  DT bindings:

   - Support building single binding targets

   - Convert google,goldfish-fb, cznic,turris-mox-rwtm, ti,prm-inst

   - Add bindings for Freescale AVIC, Realtek RTD1xxx system
     controllers, Microchip 25AA010A EEPROM, OnSemi FIN3385, IEI
     WT61P803 PUZZLE, Delta Electronics DPS-800-AB power supply,
     Infineon IR35221 Digital Multi-phase Controller, Infineon PXE1610
     Digital Dual Output 6+1 VR12.5 & VR13 CPU Controller,
     socionext,uniphier-smpctrl, and xlnx,zynqmp-firmware

   - Lots of trivial binding fixes to address warnings in DTS files.
     These are mostly for arm64 platforms which is getting closer to be
     warning free. Some public shaming has helped.

   - Fix I2C bus node names in examples

   - Drop obsolete brcm,vulcan-soc binding

   - Drop unreferenced binding headers"

* tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (60 commits)
  dt-bindings: interrupt-controller: Add compatiblie string fsl,imx(1|25|27|31|35)-avic
  dt-bindings: soc: imx: add fsl,aips and fsl,emi compatible strings
  dt-bindings: display: bridge: lt8912b: Drop reset gpio requirement
  dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated
  cpufreq: s5pv210: Simplify with scoped for each OF child loop
  dmaengine: fsl_raid: Simplify with scoped for each OF child loop
  clk: imx: imx31: Simplify with scoped for each OF child loop
  clk: imx: imx27: Simplify with scoped for each OF child loop
  cdx: Use mutex guard to simplify error handling
  cdx: Simplify with scoped for each OF child loop
  powerpc/wii: Simplify with scoped for each OF child loop
  powerpc/fsp2: Simplify with scoped for each OF child loop
  ARM: exynos: Simplify with scoped for each OF child loop
  ARM: at91: Simplify with scoped for each OF child loop
  of: Add for_each_compatible_node_scoped() helper
  dt-bindings: Fix emails with spaces or missing brackets
  scripts/dtc: Update to upstream version v1.7.2-62-ga26ef6400bd8
  dt-bindings: crypto: inside-secure,safexcel: Mandate only ring IRQs
  dt-bindings: crypto: inside-secure,safexcel: Add SoC compatibles
  of: reserved_mem: Fix placement of __free() annotation
  ...
Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc 2026-02-11T04:45:30+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-11T04:45:30+00:00 bdbddf72a2ab1cfea699959795d70df3931eefe7 Pull SoC driver updates from Arnd Bergmann: "There are are a number of to firmware drivers, in particular the TEE subsystem: - a bus callback for TEE firmware that device drivers can register to - sysfs support for tee firmware information - minor updates to platform specific TEE drivers for AMD, NXP, Qualcomm and the generic optee driver - ARM SCMI firmware refactoring to improve the protocol discover among other fixes and cleanups - ARM FF-A firmware interoperability improvements The reset controller and memory controller subsystems gain support for additional hardware platforms from Mediatek, Renesas, NXP, Canaan and SpacemiT. Most of the other changes are for random drivers/soc code. Among a number of cleanups and newly added hardware support, including: - Mediatek MT8196 DVFS power management and mailbox support - Qualcomm SCM firmware and MDT loader refactoring, as part of the new Glymur platform support. - NXP i.MX9 System Manager firmware support for accessing the syslog - Minor updates for TI, Renesas, Samsung, Apple, Marvell and AMD SoCs" * tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (171 commits) bus: fsl-mc: fix an error handling in fsl_mc_device_add() reset: spacemit: Add SpacemiT K3 reset driver reset: spacemit: Extract common K1 reset code reset: Create subdirectory for SpacemiT drivers dt-bindings: soc: spacemit: Add K3 reset support and IDs reset: canaan: k230: drop OF dependency and enable by default reset: rzg2l-usbphy-ctrl: Add suspend/resume support reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() reset: gpio: check the return value of gpiod_set_value_cansleep() reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV reset: imx8mp-audiomix: Extend the driver usage reset: imx8mp-audiomix: Switch to using regmap API reset: imx8mp-audiomix: Drop unneeded macros soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction ... 
Pull SoC driver updates from Arnd Bergmann:
 "There are are a number of to firmware drivers, in particular the TEE
  subsystem:

   - a bus callback for TEE firmware that device drivers can register to

   - sysfs support for tee firmware information

   - minor updates to platform specific TEE drivers for AMD, NXP,
     Qualcomm and the generic optee driver

   - ARM SCMI firmware refactoring to improve the protocol discover
     among other fixes and cleanups

   - ARM FF-A firmware interoperability improvements

  The reset controller and memory controller subsystems gain support for
  additional hardware platforms from Mediatek, Renesas, NXP, Canaan and
  SpacemiT.

  Most of the other changes are for random drivers/soc code. Among a
  number of cleanups and newly added hardware support, including:

   - Mediatek MT8196 DVFS power management and mailbox support

   - Qualcomm SCM firmware and MDT loader refactoring, as part of the
     new Glymur platform support.

   - NXP i.MX9 System Manager firmware support for accessing the syslog

   - Minor updates for TI, Renesas, Samsung, Apple, Marvell and AMD
     SoCs"

* tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (171 commits)
  bus: fsl-mc: fix an error handling in fsl_mc_device_add()
  reset: spacemit: Add SpacemiT K3 reset driver
  reset: spacemit: Extract common K1 reset code
  reset: Create subdirectory for SpacemiT drivers
  dt-bindings: soc: spacemit: Add K3 reset support and IDs
  reset: canaan: k230: drop OF dependency and enable by default
  reset: rzg2l-usbphy-ctrl: Add suspend/resume support
  reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits()
  reset: gpio: check the return value of gpiod_set_value_cansleep()
  reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV
  reset: imx8mp-audiomix: Extend the driver usage
  reset: imx8mp-audiomix: Switch to using regmap API
  reset: imx8mp-audiomix: Drop unneeded macros
  soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove
  soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses
  soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID
  soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support
  soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create()
  mailbox: mtk-cmdq: Add driver data to support for MT8196
  mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction
  ...
of: reserved_mem: Fix placement of __free() annotation 2026-02-04T02:58:12+00:00 Gregory CLEMENT gregory.clement@bootlin.com 2026-01-07T13:04:52+00:00 5dff92a7bde9a8ef3b709f65e347cb1c33260cf4 The __free() annotation was incorrectly placed before the variable name instead of after it, which resulted in the following checkpatch errors: ERROR: need consistent spacing around '*' (ctx:WxV) + struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx); ^ WARNING: function definition argument 'idx' should also have an identifier name + struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx); As part of this cleanup, also remove the useless return statement flagged by checkpatch. Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> Link: https://patch.msgid.link/20260107-mtd-memregion-v3-1-f9fc9107b992@bootlin.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org> 
The __free() annotation was incorrectly placed before the variable
name instead of after it, which resulted in the following checkpatch
errors:

ERROR: need consistent spacing around '*' (ctx:WxV)
+       struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx);
                                               ^
WARNING: function definition argument 'idx' should also have an identifier name
+       struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx);

As part of this cleanup, also remove the useless return statement
flagged by checkpatch.

Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://patch.msgid.link/20260107-mtd-memregion-v3-1-f9fc9107b992@bootlin.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
of: property: fw_devlink: Add support for "mmc-pwrseq" 2026-02-04T02:58:11+00:00 Francesco Valla francesco@valla.it 2026-01-10T15:27:59+00:00 04657c4060ef43c43821ace3d11e0ec12863fcd7 Add support for parsing MMC power sequencing (pwrseq) binding so that fw_devlink can enforce the dependency. Signed-off-by: Francesco Valla <francesco@valla.it> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://patch.msgid.link/20260110-mmc-pwrseq-v1-1-73de9d6456f4@valla.it Signed-off-by: Rob Herring (Arm) <robh@kernel.org> 
Add support for parsing MMC power sequencing (pwrseq) binding so that
fw_devlink can enforce the dependency.

Signed-off-by: Francesco Valla <francesco@valla.it>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://patch.msgid.link/20260110-mmc-pwrseq-v1-1-73de9d6456f4@valla.it
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>