Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Cirrus Logic CS42L43: Add support for the CS42L44 variant
   - Khadas MCU: Add support for the VIM4 MCU variant along with
     per-variant fan duty-cycle levels and optional fan supply regulator
     support
   - Maxim MAX77705: Add support for the PASS2 hardware revision
   - MediaTek MT6397: Add AUXADC sub-device support for MT6397
   - Motorola CPCAP: Support per-board sub-device compositions and add
     the Tegra20 Mot composition
   - ROHM BD73800: Add support for the BD73800 PMIC core, regulator,
     RTC, clock gate, and GPIO sub-devices
   - TI LM3533: Add VIN regulator supply support, configure initial
     backlight mapping mode from Device Tree, and implement the
     `backlight_scale` property
   - X-Powers AC200: Add support for the AC200 I2C mixed-signal companion IC

  Improvements & Fixes:
   - Cirrus Logic CS42L43: Synchronize SoundWire enumeration work in
     `remove()` before devres cleanup begins
   - Dialog DA903x: Manage IRQ work cancellation and sub-device removal
     via devres to prevent use-after-free during teardown
   - Dialog DA9150: Balance `enable_irq_wake()` with
     `disable_irq_wake()` during probe failure and driver removal
   - Intel LPSS: Add DMI quirks for Dell Latitude 5285 and 7275 to
     ignore ACPI resource conflicts on the I2C4 controller
   - Intel Quark I2C/GPIO: Manage the fixed-rate clock and its clkdev
     lookup with devres to fix a resource leak on unbind
   - Maxim MAX77705: Select `REGMAP_I2C` and `REGMAP_IRQ` in Kconfig to
     fix build errors
   - Qualcomm WCD934x: Initialize the parent DMA mask to suppress "DMA
     mask not set" warnings on child devices
   - Qualcomm WCD934x: Pass the valid device pointer to
     `dev_err_probe()` on IRQ lookup failure to avoid a NULL pointer
     dereference
   - Rockchip RK8xx: Register the poweroff handler in the atomic
     `SYS_OFF_MODE_POWER_OFF` phase so polling I2C transfers complete
     during shutdown
   - ST-Ericsson AB8500: Use `devm_mfd_add_devices()` to prevent leaking
     child devices on probe failure
   - TI BQ257xx: Mark self-modifying BQ25792 configuration registers as
     volatile
   - TI LM3533: Set `coherent_dma_mask` to zero to suppress "DMA mask
     not set" warnings
   - TI TPS65217: Check for errors during IRQ initialization and
     masking, and manage IRQ domain and wake teardown with devres
   - TI TWL: Unregister the auxiliary platform device via a devres
     action on probe failure and driver unbind

  Cleanups & Refactoring
   - Core: Convert drivers from deprecated `SIMPLE_DEV_PM_OPS()` to
     `DEFINE_SIMPLE_DEV_PM_OPS()` and `pm_sleep_ptr()`
   - Core: Fix spelling mistakes in comments across various MFD drivers
     and headers
   - Maintainers: Add ROHM BD73800 PMIC files under the ROHM PMIC entry
   - Maintainers: Specify the `for-mfd-next` branch for the MFD and
     Syscon git trees
   - Dialog DA9062: Use `DEFINE_RES_IRQ_NAMED()` for IRQ resource
     definitions
   - Intel LPSS: Simplify DebugFS handling by dropping redundant error
     checks and intermediate dentry variables, using octal permissions,
     and switching to
    `debugfs_remove()`
   - Khadas MCU: Convert MFD cell arrays to `const` and use
     `MFD_CELL_NAME()`
   - ST-Ericsson AB8500: Fix a spelling typo in a comment
   - TI LM3533: Convert from platform data to Device Tree bindings and
     pass only regmap and light sensor presence to child devices
   - TI LM3533: Remove driver-specific regmap wrappers, redundant pdata
     helpers, and unnecessary `extern` qualifiers, and use `dev_groups`
     for sysfs attributes
   - Wolfson WM831x: Fix a spelling typo in a comment

  Device Tree Binding Updates
   - HiSilicon Hi6421 SPMI: Fix the compatible string to match
     `hisilicon,hi6421-spmi`
   - MediaTek MT6357: Allow an `adc` child node
   - MediaTek MT6360: Allow two-cell interrupt specifiers with trigger
     flags
   - MediaTek MT6397: Document the `#sound-dai-cells` property
   - MediaTek MT6397: Document the battery-backed NVMEM layout under the
     RTC child node
   - MediaTek MT6397: Document the MT6323 PMIC EFUSE child node
   - Motorola CPCAP: Convert MFD and power button bindings to DT schema
     and document the Mapphone and Mot compositions
   - Qualcomm SPMI PMIC: Document the PM4125 audio codec compatible
   - Qualcomm SPMI PMIC: Document the PMAU0102 PMIC compatible
   - Qualcomm TCSR: Document the MSM8952 TCSR compatible
   - Rockchip RK805: Fold the pin controller binding into the RK805 PMIC
     DT schema
   - ROHM BD73800: Document the BD73800 PMIC and its regulators
   - ROHM PMIC: Factor out common pin properties into
     `rohm,pmic-pins.yaml` and reference them across BD71815, BD71828,
     and BD72720 bindings
   - ST-Ericsson AB8500: Document AB8500 and AB8505 buck converter
     regulators
   - ST-Ericsson AB8500: Document codec audio graph ports, sound DAI
     cells, and analog microphone wiring properties
   - ST-Ericsson DB8500 PRCMU: Deprecate the `db8500-prcmu-regulators`
     child node and make it optional
   - Syscon: Document the Ambarella CV75 secure scratchpad compatible
   - TI BQ25703A: Add the BQ25798 compatible with fallback to BQ25792
   - TI Keystone: Convert Device State Control bindings to DT schema
   - TI LM3533: Document the LM3533 LED controller, backlight, and
     indicator LED bindings
   - TI LP3943: Convert MFD and PWM bindings to DT schema
   - TI TPS61050: Convert bindings to DT schema
   - TI TPS65086: Make the `regulators` child node optional
   - TI TPS65910: Document `wakeup-source` and GPIO hog child nodes
   - TI TWL6040: Convert bindings to DT schema and align property names
     with the driver
   - X-Powers AC200: Document the AC200 mixed-signal companion IC"

* tag 'mfd-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (74 commits)
  dt-bindings: mfd: db8500-prcmu: Deprecate EPOD regulators
  dt-bindings: mfd: syscon: Add Ambarella CV75 secure scratchpad
  dt-bindings: mfd: rockchip,rk805: Convert pinctrl to DT schema
  mfd: intel-lpss: Add Dell Latitude 7275 to the resource conflict quirk
  mfd: intel-lpss: Add resource conflict quirk for Dell Latitude 5285
  mfd: tps65217: Use devres for IRQ domain and wake teardown
  mfd: tps65217: Check return value when masking interrupt sources
  mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
  dt-bindings: mfd: qcom,spmi-pmic: Add compatibles for pm4125-codec
  mfd: bq257xx: Mark self-modifying BQ25792 registers volatile
  dt-bindings: mfd: mediatek: mt6397: describe the RTC's nvmem layout
  mfd: mt6397-core: Add mt6397 AUXADC support
  mfd: max77705: Mark PASS2 revision as supported
  mfd: ab8500: Fix child device leaks on probe failure
  dt-bindings: mfd: Add MT6397 sound DAI cells
  dt-bindings: mfd: mediatek: mt6397: Add mt6323 PMIC EFUSE
  dt-bindings: mfd: hisilicon: Fix Hi6421 SPMI compatible
  dt-bindings: mfd: ti,bq25703a: Expand to include BQ25798
  dt-bindings: mfd: Allow MT6360 interrupt flags
  dt-bindings: mfd: mediatek: Allow MT6357 ADC
  ...

Pull gpio updates from Bartosz Golaszewski:
 "Nothing stands out as particularly interesting, it's been a calm
  cycle. We have three new drivers, support for more models and lots of
  updates across many modules (details are in the signed tag as usual).
  There are also some minor changes and additions to the in-kernel GPIO
  API.

  GPIO core:
   - provide a new controller API: gpiochip_generic_get_config()
   - return -EOPNOTSUPP instead of -ENODEV to user-space if it requests
     hardware timestamping on systems where it's unavailable (no
     user-space regressions reported)

  New drivers:
   - add a driver for ROHM BD73800 PMIC GPIO controller
   - add a driver for Axiado AX3005 SGPIO controller
   - add a driver for Analog Devices AD7768 GPIO controller

  New hardware support:
   - extend gpio-rcar with support for R-Car X5H (R8A78000)
   - extend gpio-tegra186 with support for Tegra 268

  Driver changes:
   - refactor and improve gpio-rtd1625: switch to modern or better
     fitting interfaces and improve coding style
   - improve error handling of return values of
     platform_get_irq_optional() in several drivers
   - normalize the return value of the gpio_chip::get() callback in
     gpio-siox in order to not propagate invalid values up to the GPIO
     core
   - implement gpio_chip::get_direction() for gpio-pcf857x
   - use managed variants of notifier registration functions in several
     drivers
   - remove legacy gpio_set_value_cansleep() as it has no more users
   - add pinctrl support to gpio-realtek-otto
   - add runtime PM support to the gpio-regmap helper module
   - add more ACPI GPIO quirks for various hardware
   - stop needlessly reading gpio_chip::base in gpio-pxa
   - add support for tracking of direction of generic GPIO chips with no
     direction registers via pinctrl backend to gpio-mmio (use the new
     core API: gpiochip_generic_get_config())
   - use the "safe" variants of debugfs_create_file() in
     gpio-sloppy-analyzer
   - use device name as GPIO chip label in gpio-omap
   - refactor bit ops in gpio-dln2
   - prepare gpio-it87 for upcoming kmalloc_obj() conversion

  Devicetree bindings:
   - document new model in gpio-pca95xx
   - allow the gpio-hogs property in gpio-zynq and fsl,qoriq-gpio
   - allow the gpio-ranges property in gpio-realtek-otto

  Misc fixes:
   - add missing MODULE_ALIAS() to gpio-crystalcove
   - fix a comment typo in example GPIO tools
   - fix unbalanced brackets in documentation
   - add names to regmaps in gpio-mvebu to avoid collisions in debugfs
     output
   - fix GPIO lookup using relative paths in GPIO ACPI"

* tag 'gpio-updates-for-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (63 commits)
  gpiolib: acpi: Fix GPIO lookup using relative path
  gpio: legacy: Kill gpio_set_value_cansleep()
  dt-bindings: gpio: pca95xx: add onnn,pca9655 with nxp,pca9555 fallback
  gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro V 16S AI
  gpio: pxa: stop reading gpio_chip::base in direction callbacks
  gpio: axiado: add AX3005 SGPIO controller support
  dt-bindings: gpio: add Axiado AX3005 SGPIO controller
  gpiolib: acpi: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
  MAINTAINERS: Add ROHM BD73800 PMIC files
  gpio: bd73800: Support ROHM BD73800 PMIC GPIOs
  clk: bd718x7: Support ROHM BD73800
  regulator: bd71828: Support ROHM BD73800
  rtc: bd70528: Support RTC on ROHM BD73800
  mfd: Support for ROHM BD73800 PMIC core
  dt-bindings: mfd: ROHM BD73800 PMIC
  dt-bindings: regulator: ROHM BD73800 regulators
  dt-bindings: rohm,bd*: Ref common ROHM bindings
  dt-bindings: mfd: Common ROHM PMIC properties
  gpio: siox: normalize return value of gpio_get()
  gpio: dln2: use assign_bit() where applicable
  ...

The Dell Latitude 7275 2-in-1 has the same BIOS bug as the Latitude 5285:
the ACPI GEXP device declares an OperationRegion (BAR0) on the GNVS
variable SB04 and the I2C4 controller (INT3446) builds its _CRS from that
same variable, so intel_lpss_acpi fails to bind the controller with
-EBUSY and the front camera sensor (OV5670, INT3479) is never registered
unless acpi_enforce_resources=lax is passed.

Add the machine to the DMI table so QUIRK_IGNORE_RESOURCE_CONFLICTS is
applied to INT3446 on it as well.

Assisted-by: LLM
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: D. Manresa <dmanresa@gmail.com>
Signed-off-by: Thierry Chatard <tchatard@gmail.com>
Link: https://patch.msgid.link/20261002163350.1248431-3-tchatard@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>

The Dell Latitude 5285 2-in-1 has a BIOS bug where the ACPI GEXP device
and the I2C4 controller (INT3446) both claim the same MMIO region via the
shared SB04 variable. This causes intel_lpss_acpi to fail binding to I2C4
with -EBUSY, preventing the front camera (OV5670) sensor from being
registered.

Match the affected machine by DMI and the affected device by ACPI ID,
carrying QUIRK_IGNORE_RESOURCE_CONFLICTS in the ACPI match data and
applying it to the per-device info in probe. This follows the quirk
organisation used by the PCI counterpart.

Assisted-by: LLM
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Thierry Chatard <tchatard@gmail.com>
Link: https://patch.msgid.link/20261002163350.1248431-2-tchatard@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>

Removing the parent device used to tear the IRQ domain down in
tps65217_remove() before the MFD children are unbound: the i2c core
only releases the parent's devres after the remove callback returns,
whereas devm_mfd_add_devices() registered its own devres action which
unbinds the children. Children that requested interrupts from the
domain (e.g. tps65217-charger) therefore call free_irq() on virtual
IRQs whose descriptors have already been disposed. With
CONFIG_SPARSE_IRQ free_irq() then returns early without stopping the
threaded handler, leaking the irqaction, the IRQ kthread and a module
reference.

Register the domain teardown as a devres action right after the domain
is created instead. Devres actions are released in reverse order of
registration, so the MFD children release their IRQs first, then the
parent interrupt is freed and its thread stopped, and only then is the
domain torn down. The same ordering covers probe failure, which no
longer needs manual cleanup, and the remove callback can be dropped
entirely.

Balance the enable_irq_wake() in tps65217_irq_init() by registering
disable_irq_wake() as a devres action as well. Only do so when
enabling actually succeeded, since the parent chip may not support
setting wake-up.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-4-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>

tps65217_irq_init() ignores the error returned by
tps65217_set_bits() when masking all interrupt sources. A failed
register write leaves the driver's software mask out of sync with the
hardware and may result in spurious interrupts.

Check the return value and propagate the error to the caller.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-3-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>

tps65217_probe() ignores the return value of tps65217_irq_init(), so
when the irq domain creation fails the probe still completes and the
driver ends up bound with a NULL tps->irq_domain. Unloading the
module then makes tps65217_remove() call irq_domain_remove() on the
NULL pointer and oops the kernel. On top of that, irq_find_mapping()
may fall back to the default irq domain and dispose of mappings that
belong to other interrupt controllers.

Check the return value and abort the probe on failure so the error
is reported and no inconsistent state is left for removal.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20261002113624.178588-2-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>

Some BQ25792 configuration registers change without being written: input
source detection sets VINDPM and IINDPM at plug-in, plug-in also clears
EN_HIZ, the FORCE_* bits clear once their operation starts or completes,
EN_ACDRV1/2 follow input path changes, and ADC_EN clears after a one-shot
conversion. Reading them from the cache returns stale values.

Mark these registers volatile, keeping the cache for the rest.

Cc: stable@vger.kernel.org
Fixes: 9adbe53e32cd ("mfd: bq257xx: Add BQ25792 support")
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Link: https://patch.msgid.link/20261001-bq25792-volatile-v1-1-cb3d4ec8a414@flipper.net
Signed-off-by: Lee Jones <lee@kernel.org>

The mt6397 PMIC includes an AUXADC. Register the AUXADC in the mt6397
devices array to allow the corresponding driver to probe using compatible
string.

Assisted-by: LLM
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Ryan Brue <ryanbrue.dev@gmail.com>
Link: https://patch.msgid.link/20260928-rbrue-suez-upstreaming-mt6397-auxadc-v4-3-23533a0d30e3@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>

The existing driver takes a safe approach and only probes on tested
MAX77705 revisions. The only tested revision at the time was
PASS3. PASS2 chips are present in the Samsung Galaxy S10/S10+/S10e
devices.

Testing on the S10 and S10+ shows the driver operates correctly on
PASS2: interrupts are registered and fire, bind and unbind release the
I2C device cleanly, and the charger and fuel gauge report plausible
values, charging the battery to the same voltage as the vendor kernel,
haptic feedback works.

Link: https://lore.kernel.org/all/20251023131732.GN475031@google.com/
Signed-off-by: Denys Romaniuk <chiffathefoxx@gmail.com>
Link: https://patch.msgid.link/20260928-max77705-pass2-supported-v2-1-c04f3932c182@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>