Commit Graph
1464154 Commits
Author SHA1 Message Date
Marc Zyngier 7258770e58 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:

- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to vcpu-B's RD to disable its LPIs
- vcpu-C moves I from B to C

If the last two race nicely enough, vgic_prune_ap_list() can drop
the irq and AP list locks, reacquire them, and in the interval
the irq has been freed. UAF follows.

The fix is two-fold:

- Before dropping the irq and ap_list locks, take a reference on
  the irq

- Do not try to handle migration of the pending bit: there is no
  expectation that this state is retained, as per the architecture

With that, we're sure that the interrupt is still around, and we
safely remove it from the AP list as it has no target at this
stage (unless another interrupt fires, but that's another story).

Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/r/ailsCnyoS82r_QRz@v4bel
Link: https://patch.msgid.link/20260615181625.3029352-1-maz@kernel.org
Fixes: 5dd4b924e3 ("KVM: arm/arm64: vgic: Add refcounting for IRQs")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
2026-06-17 12:49:07 +01:00
Linus Torvalds 231e9d447e Merge tag 'selinux-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux updates from Paul Moore:
 "A number of SELinux patches, almost all of which are either minor
  fixes or hardening patches:

   - Additional verifications when loading new SELinux policy

     Multiple patches by Christian Göttsche to add additional
     validations to the code responsible for loading and parsing SELinux
     policy as it is loaded into the kernel.

   - Avoid nontransitive comparisons comparisons in our sorting code

     Done to prevent unexpected sorting results due to overflow. Qualys
     documented a similar issue with glibc

	https://www.qualys.com/2024/01/30/qsort.txt

   - Consistently use u16 for SELinux security classes

   - Move from page allocations to kmalloc() based allocations

     Unfortunately one of these patches had to be reverted, but you
     should see a fixed version during the next merge window.

   - Move from kmalloc_objs() to kzalloc_objs() in the policy load code

   - Reorder sel_kill_sb() slightly to match other pseudo filesystems

   - Simplify things with QSTR() instead of QSTR_INIT()

   - Minor comment typo fixes"

* tag 'selinux-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: revert use of __getname() in selinux_genfs_get_sid()
  selinux: comment spelling fix in ibpkey.c
  selinux: comment typo fix in selinuxfs.c
  selinux: hooks: use __getname() to allocate path buffer
  selinux: use k[mz]alloc() to allocate temporary buffers
  selinux: check for simple types
  selinux: more strict bounds check
  selinux: beef up isvalid checks
  selinux: reorder policydb_index()
  selinux: check type attr map overflows
  selinux: check length fields in policies
  selinux: more strict policy parsing
  selinux: use u16 for security classes
  selinux: avoid nontransitive comparison
  selinux: switch two allocations to use kzalloc_objs()
  selinux: fix sel_kill_sb()
  selinux: use QSTR() instead of QSTR_INIT() in init_sel_fs
2026-06-17 12:41:00 +01:00
Linus Torvalds 87599bd298 Merge tag 'lsm-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm update from Paul Moore:
 "A single LSM update the security_inode_listsecurity() hook to be able
  to leverage the xattr_list_one() helper function.

  We wanted to do this for a while, but we needed to fixup the callers
  in the NFS code first. With the NFS code changes shipping in Linux
  v7.0 and no one complaining, it seemed a good time to complete the
  shift"

* tag 'lsm-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  security,fs,nfs,net: update security_inode_listsecurity() interface
2026-06-17 12:34:16 +01:00
Linus Torvalds 5b33fc6492 Merge tag 'sched_ext-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext updates from Tejun Heo:
 "Most of this continues the in-development sub-scheduler support, which
  lets a root BPF scheduler delegate to nested sub-schedulers. The
  dispatch-path building blocks landed in 7.1. A follow-up patchset in
  development will complete enqueue-path support for hierarchical
  scheduling. This cycle adds most of that infrastructure:

   - Topological CPU IDs (cids): a dense, topology-ordered CPU numbering
     where the CPUs of a core, LLC, or NUMA node form contiguous ranges,
     so a topology unit becomes a (start, length) slice. Raw CPU numbers
     are sparse and don't track topological closeness, which makes them
     clumsy for sharding work across sub-schedulers and awkward in BPF.

   - cmask: bitmaps windowed over a slice of cid space, so a
     sub-scheduler can track, for example, the idle cids of its shard
     without a full NR_CPUS cpumask.

   - A struct_ops variant that cid-form sub-schedulers register with,
     along with the cid-form kfuncs they call.

   - BPF arena integration, which sub-scheduler support is built on. The
     bpf-next additions let the kernel read and write the BPF
     scheduler's arena directly, turning it into a real kernel/BPF
     shared-memory channel. Shared state like the per-CPU cmask now
     lives there.

   - scx_qmap is reworked to exercise the new arena and cid interfaces.

  Additionally:

   - Exit-dump improvements: dump the faulting CPU first, expose the
     exit CPU to BPF and userspace, and normalize the dump header.

   - Misc kfuncs and cleanups: a task-ID lookup kfunc, __printf checking
     on the error and dump formatters, header reorganization, and
     assorted fixes"

* tag 'sched_ext-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (59 commits)
  sched_ext: Add scx_arena_to_kaddr() / scx_kaddr_to_arena()
  sched_ext: Make scx_bpf_kick_cid() return s32
  sched_ext: Add scx_cmask_test() and scx_cmask_for_each_cid()
  tools/sched_ext: Order single-cid cmask helpers as (cid, mask)
  sched_ext: Order single-cid cmask helpers as (cid, mask)
  selftests/sched_ext: Fix dsq_move_to_local check
  sched_ext: Guard BPF arena helper calls to fix 32-bit build
  sched_ext: idle: Fix errno loss in scx_idle_init()
  sched_ext: Convert ops.set_cmask() to arena-resident cmask
  sched_ext: Sub-allocator over kernel-claimed BPF arena pages
  sched_ext: Require an arena for cid-form schedulers
  sched_ext: Add cmask mask ops
  sched_ext: Track bits[] storage size in struct scx_cmask
  sched_ext: Rename scx_cmask.nr_bits to nr_cids
  tools/sched_ext: scx_qmap: Fix qa arena placement
  sched_ext: Mark !CONFIG_EXT_SUB_SCHED dummy stubs static inline
  sched_ext: Replace tryget_task_struct() with get_task_struct()
  sched_ext: Add scx_task_iter_relock() and use it in scx_root_enable_workfn()
  sched_ext: Fix ops_cid layout assert
  sched_ext: Use offsetofend on both sides of the ops_cid layout assert
  ...
2026-06-17 12:10:11 +01:00
Linus Torvalds 83476cc97b Merge tag 'cgroup-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:

 - Last cycle deferred css teardown on cgroup removal until the cgroup
   depopulated, so a css is not taken offline while tasks can still
   reference it. Disabling a controller through cgroup.subtree_control
   still had the same problem. This reworks the deferral from per-cgroup
   to per-css so that path is covered too.

 - New RDMA controller monitoring files: rdma.peak for per-device peak
   usage and rdma.events / rdma.events.local for resource-limit
   exhaustion. The max-limit parser was rewritten, fixing two input
   parsing bugs.

 - cpuset: fix a sched-domain leak on the domain-rebuild failure path
   and skip a redundant hardwall ancestor scan on v2.

 - Misc: pair the remaining lockless cgroup.max.* reads with WRITE_ONCE,
   assorted selftest robustness fixes, and doc path corrections.

* tag 'cgroup-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (22 commits)
  cgroup: Migrate tasks to the root css when a controller is rebound
  docs: cgroup: Fix stale source file paths
  cgroup/cpuset: Free sched domains on rebuild guard failure
  cgroup: pair max limit READ_ONCE() with WRITE_ONCE()
  selftests/cgroup: enable memory controller in hugetlb memcg test
  cgroup/rdma: Drop unnecessary READ_ONCE() on event counters
  cgroup: Defer kill_css_finish() in cgroup_apply_control_disable()
  cgroup: Add per-subsys-css kill_css_finish deferral
  cgroup: Move populated counters to cgroup_subsys_state
  cgroup: Annotate unlocked nr_populated_* accesses with READ_ONCE/WRITE_ONCE
  cgroup: Inline cgroup_has_tasks() in cgroup.h
  cgroup/rdma: document rdma.peak, rdma.events and rdma.events.local
  cgroup/rdma: add rdma.events.local for per-cgroup allocation failure attribution
  cgroup/rdma: add rdma.events to track resource limit exhaustion
  cgroup/rdma: add rdma.peak for per-device peak usage tracking
  selftests/cgroup: check malloc return value in alloc_anon functions
  cgroup/cpuset: Skip hardwall ancestor scan in cpuset v2 in cpuset_current_node_allowed()
  selftests/cgroup: fix misleading debug message in test_cgfreezer_time_child
  selftests/cgroup: fix child process escaping to parent cleanup in test_cpucg_nice
  selftests/cgroup: Add NULL check after malloc in cgroup_util.c
  ...
2026-06-17 12:03:56 +01:00
Linus Torvalds d4d9d39f04 Merge tag 'wq-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue updates from Tejun Heo:

 - Continued progress toward making alloc_workqueue() unbound by
   default: more callers converted to WQ_PERCPU / system_percpu_wq /
   system_dfl_wq, and new warnings for queues that use neither WQ_PERCPU
   nor WQ_UNBOUND or the legacy system_wq / system_unbound_wq.

 - Misc: drop the now-trivial apply_wqattrs_lock()/unlock() wrappers,
   forbid the TEST_WORKQUEUE benchmark from being built-in, and fix a
   spurious pointer level in the worker debug-dump path.

* tag 'wq-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  drm/bridge: anx7625: Add WQ_PERCPU add to alloc_workqueue
  wifi: ath6kl: fix invalid workqueue flags in ath6kl_usb_create()
  btrfs: Drop WQ_PERCPU from ordered_flags in btrfs_init_workqueues()
  workqueue: Add warnings and ensure one among WQ_PERCPU or WQ_UNBOUND is present
  workqueue: Add warnings and fallback if system_{unbound}_wq is used
  workqueue: drop spurious '*' from print_worker_info() fn declaration
  workqueue: forbid TEST_WORKQUEUE from being built-in
  workqueue: drop apply_wqattrs_lock()/unlock() wrappers
  umh: replace use of system_unbound_wq with system_dfl_wq
  rapidio: rio: add WQ_PERCPU to alloc_workqueue users
  media: ddbridge: add WQ_PERCPU to alloc_workqueue users
  platform: cznic: turris-omnia-mcu: replace use of system_wq with system_percpu_wq
  media: synopsys: hdmirx: replace use of system_unbound_wq with system_dfl_wq
  virt: acrn: Add WQ_PERCPU to alloc_workqueue users
2026-06-17 11:57:44 +01:00
Linus Torvalds 59a6c7ac0a Merge tag 'bitmap-for-7.2' of https://github.com/norov/linux
Pull bitmap updates from Yury Norov:
 "This includes the new FIELD_GET_SIGNED() helper,
  bitmap_print_to_pagebuf() removal, RISCV/bitrev support, and a couple
  cleanups.

   - new handy helper FIELD_GET_SIGNED() (Yury)

   - arch test_and_set_bit_lock() and clear_bit_unlock() cleanup (Randy)

   - __bf_shf() simplification (Yury)

   - bitmap_print_to_pagebuf() removal (Yury)

   - RISCV/bitrev conditional support (Jindie, Yury)"

* tag 'bitmap-for-7.2' of https://github.com/norov/linux:
  MAINTAINERS: BITOPS: include bitrev.[ch]
  arch/riscv: Add bitrev.h file to support rev8 and brev8
  bitops: Define generic___bitrev8/16/32 for reuse
  lib/bitrev: Introduce GENERIC_BITREVERSE
  arch: select HAVE_ARCH_BITREVERSE conditionally on BITREVERSE
  bitmap: fix find helper documentation
  bitmap: drop bitmap_print_to_pagebuf()
  cpumask: switch cpumap_print_to_pagebuf() to using scnprintf()
  bitfield: wire __bf_shf to __builtin_ctzll
  bitops: use common function parameter names
  ptp: switch to using FIELD_GET_SIGNED()
  rtc: rv3032: switch to using FIELD_GET_SIGNED()
  wifi: rtw89: switch to using FIELD_GET_SIGNED()
  iio: mcp9600: switch to using FIELD_GET_SIGNED()
  iio: pressure: bmp280: switch to using FIELD_GET_SIGNED()
  iio: magnetometer: yas530: switch to using FIELD_GET_SIGNED()
  iio: intel_dc_ti_adc: switch to using FIELD_GET_SIGNED()
  x86/extable: switch to using FIELD_GET_SIGNED()
  bitfield: add FIELD_GET_SIGNED()
2026-06-17 11:38:38 +01:00
Linus Torvalds 8479bb8c44 Merge tag 'modules-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
Pull modules updates from Sami Tolvanen:

 - Add a missing return value check for module_extend_max_pages() to
   prevent a kernel oops on memory allocation failure.

 - Force sh_addr to 0 for architecture-specific module sections on arm,
   arm64, m68k, and riscv. This prevents non-zero section addresses when
   linking modules with ld.bfd -r, which may cause tools to misbehave
   and result in worse compressibility.

 - Replace pr_warn! with pr_warn_once! for set_param null pointer
   warnings in Rust abstractions, now that the _once variant is
   available.

* tag 'modules-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  rust: module_param: add missing newline to pr_warn_once
  module: decompress: check return value of module_extend_max_pages()
  rust: module_param: use `pr_warn_once!` for null pointer warning
  module, riscv: force sh_addr=0 for arch-specific sections
  module, m68k: force sh_addr=0 for arch-specific sections
  module, arm64: force sh_addr=0 for arch-specific sections
  module, arm: force sh_addr=0 for arch-specific sections
2026-06-17 11:35:58 +01:00
Krzysztof Kozlowski c454531af7 dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
Revert commit 51284d8b1dbc ("dt-bindings: mfd: syscon: Document the
LVDS_CMN syscon for the RZ/G3L") because it is completely not matching
reality and clearly incorrect in respect of renesas,r9a08g046-lvds-cmn.

It wasn't ever build-tested by author on their DTS, either.

The documented renesas,r9a08g046-lvds-cmn compatible clearly disallows
any children and simple-mfd fallback, however its only use in original
patchset is with simple-mfd and children, so this could have never
worked.

Fixes: 51284d8b1dbc ("dt-bindings: mfd: syscon: Document the LVDS_CMN syscon for the RZ/G3L")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260608115507.134969-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:12 +01:00
Manish Baing f167dc91ae dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
The st,stmpe-pwm binding is already covered by the MFD schema in
Documentation/devicetree/bindings/mfd/st,stmpe.yaml. However, the
PWM subnode was missing a 'required' properties block. This allowed
Device Tree nodes to pass validation even if the 'compatible'
string was omitted. This omission could lead to probe failures
at runtime.

Fix the schema by adding the missing 'required' block.

Signed-off-by: Manish Baing <manishbaing2789@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Uwe Kleine-König <ukleinek@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260523173251.72540-2-manishbaing2789@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:10 +01:00
Cosmin Tanislav f6b692d1f4 mfd: rz-mtu3: Make reset optional
The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs do not have a
reset line for the MTU3 block.

Prepare for them by making it optional.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-5-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:08 +01:00
Cosmin Tanislav a3bd9f3dd5 mfd: rz-mtu3: Store &pdev->dev in local variable
&pdev->dev is accessed multiple times during probe. Store it in a local
variable and use that to simplify the code.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-4-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:05 +01:00
Cosmin Tanislav 4bf15cafe9 mfd: rz-mtu3: Use local variable for reset
Remove struct rz_mtu3_priv::rstc and use a local variable for it as it
is not needed outside of rz_mtu3_probe() anymore.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-3-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:03 +01:00
Cosmin Tanislav ed1a370da2 mfd: rz-mtu3: Use device-managed APIs
Replace devm_reset_control_get_exclusive() and the manual
reset_control_deassert()/reset_control_assert() with handling by
devm_reset_control_get_exclusive_deasserted().

Replace mfd_add_devices()/mfd_remove_devices() with
devm_mfd_add_devices().

Remove the custom cleanup action.

Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260527145606.136536-2-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:33:00 +01:00
Billy Tsai 960b38750b dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
The AST2700 SoC integrates two interconnected SoC instances, each
managed by its own System Control Unit (SCU).

Allow the AST2700 SoC1 pin controller to be described as a child
node of the SCU by extending the compatible strings accepted by
the SCU binding.

There is no functional change to the SCU binding beyond permitting
the aspeed,ast2700-soc1-pinctrl compatible string.

Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260521-pinctrl-single-bit-v5-1-308be2c160fc@aspeedtech.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:58 +01:00
Bartosz Golaszewski 3001ed2b4e mfd: tps6586x: Fix OF node refcount
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 62f6b08793 ("tps6586x: Add device tree support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:56 +01:00
Otto Pflüger 28ad23ef7f dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
The SC2730 PMIC provides a different set of regulators than SC2731 and
thus requires separate regulator bindings. Allow using them for the
"regulators" node.

Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260519-sc2730-regulators-v3-2-5bf0e02507e3@abscue.de
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:53 +01:00
Ethan Nelson-Moore 7aa3d8aba5 mfd: twl4030-power: Update checks for specific boards to use the DT
The twl4030-power driver contains two checks for ARM machine IDs via
machine_is_*() macros. The two boards concerned now support only FDT
booting, which does not use machine IDs, and therefore the code should
be updated to check the DT compatible property instead.
The legacy board files for these machines were removed in
commit 1b383f44aa ("ARM: OMAP2+: Drop board file for 3430sdp") and
commit e92fc4f04a ("ARM: OMAP2+: Drop legacy board file for LDP").
The presence of these machine ID checks prevents the removal of machine
IDs no longer used by the kernel from arch/arm/tools/mach-types,
because the machine_is_*() macros are generated from mach-types. To
resolve this issue, use of_machine_is_compatible() instead.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260517023723.92731-2-enelsonmoore@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:51 +01:00
Kathiravan Thirumoorthy 45a1d5f196 dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
Document the TCSR block found on the Qualcomm's IPQ5210 SoC.

Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260511-ipq5210_tcsr_binding-v1-1-c8d20fed014f@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:48 +01:00
Antony Kurniawan Soemardi 6b6e7e965a mfd: qcom_rpm: Add msm8960 QDSS clock resource
The msm8960 RPM resource table is missing the QDSS clock entry (resource
ID 209) that is present in the android-msm-mako-3.4 downstream kernel.
Add it so that RPM clock initialization succeeds.

Tested-by: Rudraksha Gupta <guptarud@gmail.com>
Signed-off-by: Antony Kurniawan Soemardi <linux@smankusors.com>
Link: https://patch.msgid.link/20260514-msm8960-wifi-v2-3-7cbae45dab5e@smankusors.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:46 +01:00
Md Shofiqul Islam a44ec8fd38 mfd: si476x-i2c: Fix spelling mistakes in comments
Fix spelling mistake in comments:
 - succes -> success (4 times)

Signed-off-by: Md Shofiqul Islam <shofiqtest@gmail.com>
Link: https://patch.msgid.link/20260514181954.1442-1-shofiqtest@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:44 +01:00
Diogo Ivo f01e402beb mfd: max77620: Convert poweroff support to sys-off API
Convert max77620_pm_power_off() to the sys-off callback prototype and
register it with the sys-off API when the device tree marks the PMIC as
a system power controller. This also removes the global max77620_scratch
pointer by passing the chip instance through the callback data.

This modernizes the driver's poweroff handling and aligns it with
the kernel sys-off infrastructure.

Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
Link: https://patch.msgid.link/20260514-smaug-poweroff-v1-2-30f9a4688966@tecnico.ulisboa.pt
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:41 +01:00
Chen-Yu Tsai 7502c035b8 mfd: dt-bindings: mt6397: Add regulator supplies
On the MT6397 family each buck regulator has a separate supply. LDOs are
split into various groups with independent supplies. There is also a
supply for the regulator control logic.

Add descriptions for all of the supplies for the MT6359.

Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260514091520.2718987-2-wenst@chromium.org
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:38 +01:00
Louis-Alexis Eyraud 078ca283be dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
MT6365 PMIC is compatible with MT6359, so add the compatible strings
for the main and sub devices (regulator, rtc, audio codec).

Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260429-mediatek-genio-mt6365-cleanup-v1-2-6f43838be92f@collabora.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:35 +01:00
Louis-Alexis Eyraud 616207451d dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
The rtc block of MT6359 PMIC is compatible with the one found in MT6358
but this compatibility was never expressed in the dt-bindings, so add
the missing compatible string for the rtc subnode.

Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260429-mediatek-genio-mt6365-cleanup-v1-1-6f43838be92f@collabora.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:32 +01:00
Charles Keepax b6ef1a74b3 mfd: cs42l43: Sanity check firmware size
Currently the code checks if a firmware was received, however it does
not verify that the firmware size is larger than the firmware header. As
the firmware pointer is dereferenced as a pointer to the header
structure this could lead to an out of bounds memory access. Add the
missing check.

Fixes: ace6d14481 ("mfd: cs42l43: Add support for cs42l43 core driver")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260508134804.1787461-1-ckeepax@opensource.cirrus.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:30 +01:00
Krzysztof Kozlowski 1cd125db93 mfd: qcom: Unify user-visible "Qualcomm" name
Various names for Qualcomm as a company are used in user-visible config
options: QCOM, Qualcomm and Qualcomm Technologies.  Switch to unified
"Qualcomm" so it will be easier for users to identify the options when
for example running menuconfig.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Guru Das Srinagesh <linux@gurudas.dev>
Link: https://patch.msgid.link/20260427070109.18271-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:27 +01:00
Andrei Kuchynski 8b2c1d41bc mfd: cros_ec: Delay dev_set_drvdata() until probe success
If ec_device_probe() fails, cros_ec_class_release releases memory for the
cros_ec_dev structure. However, because the drvdata was already set,
sub-drivers like cros_ec_typec can still retrieve the stale pointer via the
platform device. This leads to a use-after-free when cros_ec_typec attempts
to access &typec->ec->ec->dev on a device that has already been released.
Move dev_set_drvdata() to ensure that the pointer is only made available
once all initialization steps have succeeded.

 sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'
 Call trace:
  sysfs_do_create_link_sd+0x94/0xdc
  sysfs_create_link+0x30/0x44
  device_add_class_symlinks+0x90/0x13c
  device_add+0xf0/0x50c
  ec_device_probe+0x150/0x4f0
  platform_probe+0xa0/0xe0
 ...
 BUG: KASAN: invalid-access in __memcpy+0x44/0x230
 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125
 Pointer tag: [f5], memory tag: [fe]
 Tainted : [W]=WARN, [O]=OOT_MODULE
 Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3
 Workqueue: events_unbound deferred_probe_work_func
 Call trace:
  __memcpy+0x44/0x230
  cros_ec_check_features+0x60/0xcc [cros_ec_proto]
  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]
  platform_probe+0xa0/0xe0

Cc: stable@vger.kernel.org
Fixes: 1c1d152cc5 ("platform/chrome: cros_ec_dev - utilize new cdev_device_add helper function")
Co-developed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://patch.msgid.link/20260427131721.1165078-1-akuchynski@chromium.org
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:23 +01:00
Billy Tsai 2611c4d623 dt-bindings: mfd: aspeed,ast2x00-scu: Describe AST2700 SCU0
AST2700 consists of two interconnected SoC instances, each with its own
System Control Unit (SCU). The SCU0 provides pin control, interrupt
controllers, clocks, resets, and address-space mappings for the
Secondary and Tertiary Service Processors (SSP and TSP).

Describe the SSP/TSP address mappings using the standard
memory-region and memory-region-names properties.

Disallow legacy child nodes that are not present on AST2700, including
p2a-control and smp-memram. The latter is unnecessary as software can
access the scratch registers via the SCU syscon.

Also allow the AST2700 SoC0 pin controller to be described as a child
node of the SCU0, and add an example illustrating the SCU0 layout,
including reserved-memory, interrupt controllers, and pinctrl.

Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260428-upstream_pinctrl-v8-2-eb8ef9ab0498@aspeedtech.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:17 +01:00
Arnd Bergmann e6f0018fbf mfd: ezx-pcap: Remove unused driver
Support for the Motorola EZX phones based on Intel PXA processors was
removed in 2022, but this driver remained present in the tree. As far
as I can tell, the support was never quite functional upstream because
the board files did not actually instantiate the SPI device for the PCAP.

There are still also drivers for the various mfd cells: keys, touchscreen,
regulator and rtc, all of which are obviously orphaned as well but can
be removed separately as the Kconfig dependency now prevents them from
being enabled.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202604301209.f1YXTsIr-lkp@intel.com/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Acked-by: Harald Welte <laforge@gnumonks.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260430162855.2029285-1-arnd@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:14 +01:00
Thorsten Blum 7ee4fa2674 mfd: twl-core: Use i2c_check_functionality as boolean value
i2c_check_functionality() returns a boolean status rather than an error
code - directly use it as a boolean value.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260505114543.159381-2-thorsten.blum@linux.dev
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:12 +01:00
Thorsten Blum d11880e32e mfd: menf21bmc: Inline i2c_check_functionality check
Inline the i2c_check_functionality() check, since the function returns a
boolean status rather than an error code.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260428165800.590496-3-thorsten.blum@linux.dev
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:09 +01:00
Deepti Jaggi 484c67469d dt-bindings: mfd: qcom,tcsr: Add compatible for Nord
Document Top Control and Status Register (TCSR) controller on Qualcomm
Nord SoC.

Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260504081122.825635-1-shengchao.guo@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:07 +01:00
Amit Sunil Dhamne 7b7b7fa42d mfd: max77759: Improve static struct formatting and commentary
Improve code style. This includes the following:
- Formatting the max77759_chgr_irqs entries to fit in a single line
  instead of breaking them into multiple lines to improve readability.

- Refactoring comments such that they're full sentences and have
  punctuation marks for a couple of macro definitions to adhere to the
  documentation style.

- Explicitly initializing `MAX77759_CHGR_MODE_OFF`.

Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Link: https://patch.msgid.link/20260504-fix-mfd-max77759-driver-v1-1-4d4a31a1d214@google.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:03 +01:00
Arnd Bergmann 5618127fed mfd: wm8994: Remove dead legacy-gpio code
The old-style gpio handling in wm8994 came from a commit 7c8844481a
("mfd: wm8994: Emulate level triggered interrupts if required") in
linux-3.11, but nothing in the kernel ever set the 'irq_gpio' member
in the wm8994_pdata structure, so this was always dead code.

Remove it now to reduce the dependency on the legacy gpio interfaces.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260427143437.3059210-1-arnd@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:32:00 +01:00
Bartosz Golaszewski 4b51f0da73 mfd: cs5535: Add, assign and expose the software node for the GPIO cell
There are board files in-tree that want to request GPIOs from this chip.
They currently rely on the GPIO core's mechanism of matching software
nodes' labels against GPIO controller names. We want to remove this
behavior from the kernel and to this end, we need to associate the
referenced GPIO controller with its target software node.

Create a dedicated GPIO software node for cs5535, assign it to the GPIO
cell and expose its address in a new header.

We only expose a single software node instance but that's alright: all
existing hardware only contains a single cs5535 companion and the geode
board file for which we expose this is legacy anyway.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260429-cs5535-swnode-v1-1-2bc5e17ddcf9@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:31:55 +01:00
Uwe Kleine-König (The Capable Hub) ade13e2b7b mfd: Consistently define pci_device_ids using named initializers
The various struct pci_device_id arrays were initialized mostly by one
of the PCI_DEVICE macros and then list expressions. The latter isn't
easily readable if you're not into PCI. Using named initializers is more
explicit and thus easier to parse.

The secret plan is to make struct pci_device_id::driver_data an
anonymous union (similar to
https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/)
and that requires named initializers. But it's also a nice cleanup on
its own.

This change doesn't introduce changes to the compiled pci_device_id
arrays. Tested on x86 and arm64.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260429170652.4178050-2-u.kleine-koenig@baylibre.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:31:17 +01:00
Matthew Bystrin d18fd55c78 mfd: rsmu: Add 8a34002 support
Add compatible string, i2c_devcie_id and spi_devcie_id to support
8a34002.

Signed-off-by: Matthew Bystrin <dev.mbstr@gmail.com>
Link: https://patch.msgid.link/20260429072047.1111427-3-dev.mbstr@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:31:13 +01:00
Matthew Bystrin 6bc38f26ed mfd: rsmu: Fix page register setup
Fix writes to page register in 8A3400x family (Clock Matrix).

All calls to rsmu_write_page_register() (both in i2c and spi) have
resulted in early return, because all addresses in
include/linux/mfd/idt8a340_reg.h are less than RSMU_CM_SCSR_BASE.

There were 2 separate patch series which have to be merged in one time:
mfd and ptp. The latter have been merged, the former[1] have not.

Link: https://lore.kernel.org/netdev/LV3P220MB1202F8E2FCCFBA2519B4966EA0192@LV3P220MB1202.NAMP220.PROD.OUTLOOK.COM/
Fixes: 67d6c76fc8 ("mfd: rsmu: Support 32-bit address space")
Signed-off-by: Matthew Bystrin <dev.mbstr@gmail.com>
Link: https://patch.msgid.link/20260429072047.1111427-2-dev.mbstr@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:31:09 +01:00
Krzysztof Kozlowski 4dd72d0044 mfd: MAINTAINERS: Remove Krzysztof from Samsung PMIC drivers
Due to lack of time I did not perform reviews of patches for Samsung
PMIC drivers last year, at least not in timely manner.  I still can
perform limited testing of the code on hardware, but that does not
warrant having "M" here.

Maintainer should be responsive, so drop my name and shift these drivers
maintenance to André Draszik (from previous reviewer role).

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: André Draszik <andre.draszik@linaro.org>
Link: https://patch.msgid.link/20260428135216.100135-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:31:05 +01:00
Shaunak Datar 82f0918230 dt-bindings: mfd: hisilicon,hi655x-pmic: Convert to DT schema
Convert the Hisilicon Hi655x PMIC binding from the text format to DT schema
to enable dtbs_check validation.

The 'regulators' child node is added based on existing usage in
arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts, which defines child
regulator nodes not documented in the original .txt binding.

The uppercase LDO names are retained to match existing DTS usage.

Signed-off-by: Shaunak Datar <shaunakkdatar@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260423113237.260652-1-shaunakkdatar@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:58 +01:00
Ronald Claveau 39dd85d924 dt-bindings: mfd: khadas: Add new compatible for Khadas VIM4 MCU
The Khadas VIM4 MCU register is slightly different
from previous boards' MCU.
This board also features a switchable power source for its fan.

Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260421-add-mcu-fan-khadas-vim4-v4-1-447114a28f2d@aliel.fr
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:55 +01:00
Biju Das 68d574451d dt-bindings: mfd: syscon: Document the LVDS_CMN syscon for the RZ/G3L
The RZ/G3{E,L} SoCs have an LVDS Common (LVDS_CMN) region which is common
to all LVDS channels. The RZ/G3L has single-link, but the RZ/G3E has both
single and dual-link.

Use the syscon interface to access these registers for scalability.

Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260421172910.218497-2-biju.das.jz@bp.renesas.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:51 +01:00
Jameson Thies 17f9528183 mfd: cros_ec: Don't add cros_ec_ucsi if it is defined in OF or ACPI
On devices with a UCSI PPM in the EC, check for cros_ec_ucsi to be
defined in the OF device tree or an ACPI node. If it is defined by
either OF or ACPI, it does not need to be added as a subdevice of
cros_ec_dev mfd. cros_ec_ucsi will load from the OF or ACPI node.

Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Link: https://patch.msgid.link/20260403222253.1888991-2-jthies@google.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:48 +01:00
Guangshuo Li 8c2f0b42fc mfd: sm501: Fix reference leak on failed device registration
When platform_device_register() fails in sm501_register_device(), the
embedded struct device in pdev has already been initialized by
device_initialize(), but the failure path only reports the error and
returns without dropping the device reference for the current platform
device:

  sm501_register_device()
    -> platform_device_register(pdev)
       -> device_initialize(&pdev->dev)
       -> setup_pdev_dma_masks(pdev)
       -> platform_device_add(pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: b6d6454fdb ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:45 +01:00
Alexey Charkov 9adbe53e32 mfd: bq257xx: Add BQ25792 support
Add register definitions and a new 'type' enum to be passed via MFD
private data to support the BQ25792, which is a newer variant of the
BQ257xx family.

BQ25792 shares similar logic of operation with the already supported
BQ25703A but has a completely different register map and different
electrical constraints.

Signed-off-by: Alexey Charkov <alchark@flipper.net>
Tested-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260331-bq25792-v6-9-0278fba33eb9@flipper.net
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:35 +01:00
Alexey Charkov 583003fe5e dt-bindings: mfd: ti,bq25703a: Expand to include BQ25792
TI BQ25792 is similar in operation to BQ25703A, but has a different
register layout and different current/voltage capabilities.

Expand the existing BQ25703A binding to include BQ25792, and move the
voltage and current limits into per-variant conditional statements.

Signed-off-by: Alexey Charkov <alchark@flipper.net>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Tested-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260331-bq25792-v6-1-0278fba33eb9@flipper.net
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:31 +01:00
Aurelien Jarno 25c80f08e5 mfd: simple-mfd-i2c: Add a reboot cell for the SpacemiT P1 chip
Add a "spacemit-p1-reboot" cell for the SpacemiT P1 chip.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Tested-by: Vincent Legoll <legoll@online.fr> # OrangePi-RV2
Link: https://patch.msgid.link/20251102230352.914421-3-aurelien@aurel32.net
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:28 +01:00
Matti Vaittinen 6a2cb13761 mfd: bd72720: Drop BUCK11 ID
The BD72720 header reserves an ID for BUCK11. While this does not (at
the moment) cause problems I can see, it is misleading as the BD72720
contains only 10 BUCKs.

Make the code clearer and drop the BUCK11 ID.

Fixes: af25277b1d ("mfd: rohm-bd71828: Support ROHM BD72720")
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Link: https://patch.msgid.link/812c3749a18d609d6f4698506bc516ec7183dfdd.1775565298.git.mazziesaccount@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:26 +01:00
Otto Pflüger 3c8658d6b5 mfd: sprd-sc27xx: Switch to devm_mfd_add_devices()
To allow instantiating subdevices such as the regulator and poweroff
devices that do not have corresponding device tree nodes with a
"compatible" property, use devm_mfd_add_devices() with MFD cells instead
of devm_of_platform_populate(). Since different PMICs in the SC27xx
series contain different components, use separate MFD cell tables for
each PMIC model. Define cells for all components that have upstream
drivers at this point.

Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
Link: https://patch.msgid.link/20260329-sc27xx-mfd-cells-v3-3-9158dee41f74@abscue.de
Signed-off-by: Lee Jones <lee@kernel.org>
2026-06-17 11:30:22 +01:00