[PATCH 0/3] Convert ti,irq-crossbar binding to DT schema

[PATCH 0/3] Convert ti,irq-crossbar binding to DT schema

[Bhargav Joshi]

This series converts the TI IRQ Crossbar binding from the legacy text
format to a YAML DT schema and resolves a property name conflict with
an existing binding.

The property name 'ti,irqs-reserved' is already defined in
ti,pruss-intc.yaml as a uint8 bitmask. while irq-crossbar uses it as
uint32-array causing dtbs_binding_check errors.

To resolve errors following changes are introduced: 

  1. Rename the property to 'ti,crossbar-irqs-reserved'
  2. Update driver to accept both old and new names.
  3. Update DTS to use the new name.

Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
---
Bhargav Joshi (3):
      dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema
      irqchip: irq-crossbar: Handle renamed irqs-reserved property
      ARM: dts: omap: dra7: Use new property name ti,crossbar-irqs-reserved

 .../devicetree/bindings/arm/omap/crossbar.txt      | 55 ------------
 .../interrupt-controller/ti,irq-crossbar.yaml      | 98 ++++++++++++++++++++++
 arch/arm/boot/dts/ti/omap/dra7.dtsi                |  2 +-
 drivers/irqchip/irq-crossbar.c                     | 15 +++-
 4 files changed, 111 insertions(+), 59 deletions(-)
---
base-commit: eb3f4b7426cfd2b79d65b7d37155480b32259a11
change-id: 20260528-crossbar-2b9a641d2146

Best regards,
-- 
Bhargav

[PATCH 1/3] dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema

[Bhargav Joshi]

Convert TI irq-crossbar binding from text format to DT schema.

As part of conversion following changes are made:
 - Add '#interrupt-cells' as a required property which was missing in
   text binding
 - As irq-crossbar is interrupt-controller. Move binding from
   bindings/arm/omap to bindings/interrupt-controller
 - property ti,irqs-reserved is defined and used as a array but other
   binding ti,pruss-intc.yaml uses same property name as a unit8 bitmask
   which causes erros in dt_binding_check. Update ti,irqs-reserved
   property name to ti,crossbar-irqs-reserved to resolve duplicate naming.

Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
---
 .../devicetree/bindings/arm/omap/crossbar.txt      | 55 ------------
 .../interrupt-controller/ti,irq-crossbar.yaml      | 98 ++++++++++++++++++++++
 2 files changed, 98 insertions(+), 55 deletions(-)

diff --git a/Documentation/devicetree/bindings/arm/omap/crossbar.txt b/Documentation/devicetree/bindings/arm/omap/crossbar.txt
deleted file mode 100644
index a43e4c7aba3d..000000000000
--- a/Documentation/devicetree/bindings/arm/omap/crossbar.txt
+++ /dev/null
@@ -1,55 +0,0 @@
-Some socs have a large number of interrupts requests to service
-the needs of its many peripherals and subsystems. All of the
-interrupt lines from the subsystems are not needed at the same
-time, so they have to be muxed to the irq-controller appropriately.
-In such places a interrupt controllers are preceded by an CROSSBAR
-that provides flexibility in muxing the device requests to the controller
-inputs.
-
-Required properties:
-- compatible : Should be "ti,irq-crossbar"
-- reg: Base address and the size of the crossbar registers.
-- interrupt-controller: indicates that this block is an interrupt controller.
-- ti,max-irqs: Total number of irqs available at the parent interrupt controller.
-- ti,max-crossbar-sources: Maximum number of crossbar sources that can be routed.
-- ti,reg-size: Size of a individual register in bytes. Every individual
-	    register is assumed to be of same size. Valid sizes are 1, 2, 4.
-- ti,irqs-reserved: List of the reserved irq lines that are not muxed using
-		 crossbar. These interrupt lines are reserved in the soc,
-		 so crossbar bar driver should not consider them as free
-		 lines.
-
-Optional properties:
-- ti,irqs-skip: This is similar to "ti,irqs-reserved", but these are for
-  SOC-specific hard-wiring of those irqs which unexpectedly bypasses the
-  crossbar. These irqs have a crossbar register, but still cannot be used.
-
-- ti,irqs-safe-map: integer which maps to a safe configuration to use
-  when the interrupt controller irq is unused (when not provided, default is 0)
-
-Examples:
-		crossbar_mpu: crossbar@4a002a48 {
-			compatible = "ti,irq-crossbar";
-			reg = <0x4a002a48 0x130>;
-			ti,max-irqs = <160>;
-			ti,max-crossbar-sources = <400>;
-			ti,reg-size = <2>;
-			ti,irqs-reserved = <0 1 2 3 5 6 131 132>;
-			ti,irqs-skip = <10 133 139 140>;
-		};
-
-Consumer:
-========
-See Documentation/devicetree/bindings/interrupt-controller/interrupts.txt and
-Documentation/devicetree/bindings/interrupt-controller/arm,gic.yaml for
-further details.
-
-An interrupt consumer on an SoC using crossbar will use:
-	interrupts = <GIC_SPI request_number interrupt_level>
-
-Example:
-	device_x@4a023000 {
-		/* Crossbar 8 used */
-		interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
-		...
-	};
diff --git a/Documentation/devicetree/bindings/interrupt-controller/ti,irq-crossbar.yaml b/Documentation/devicetree/bindings/interrupt-controller/ti,irq-crossbar.yaml
new file mode 100644
index 000000000000..b31e147c2672
--- /dev/null
+++ b/Documentation/devicetree/bindings/interrupt-controller/ti,irq-crossbar.yaml
@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/interrupt-controller/ti,irq-crossbar.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Texas Instruments IRQ Crossbar
+
+maintainers:
+  - Sricharan R <r.sricharan@ti.com>
+
+description:
+  Some socs have a large number of interrupts requests to service the needs of
+  its many peripherals and subsystems. All of the interrupt lines from the
+  subsystems are not needed at the same time, so they have to be muxed to the
+  irq-controller appropriately. In such places a interrupt controllers are
+  preceded by an CROSSBAR that provides flexibility in muxing the device
+  requests to the controller inputs.
+
+properties:
+  compatible:
+    const: ti,irq-crossbar
+
+  reg:
+    maxItems: 1
+
+  interrupt-controller: true
+
+  '#interrupt-cells':
+    const: 3
+
+  ti,max-irqs:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description:
+      Total number of irqs available at the parent interrupt controller.
+    minimum: 1
+
+  ti,max-crossbar-sources:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description:
+      Maximum number of crossbar sources that can be routed.
+    minimum: 1
+
+  ti,reg-size:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description:
+      Size of a individual register in bytes. Every individual
+      register is assumed to be of same size.
+    enum: [1, 2, 4]
+
+  ti,crossbar-irqs-reserved:
+    $ref: /schemas/types.yaml#/definitions/uint32-array
+    description:
+      List of the reserved irq lines that are not muxed using crossbar. These
+      interrupt lines are reserved in the soc, so crossbar bar driver should not
+      consider them as free lines.
+
+  ti,irqs-skip:
+    $ref: /schemas/types.yaml#/definitions/uint32-array
+    description:
+      Similar to "ti,crossbar-irqs-reserved", but these are for SOC-specific hard-wiring
+      of those irqs which unexpectedly bypasses the crossbar. These irqs have a
+      crossbar register, but still cannot be used.
+
+  ti,irqs-safe-map:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description:
+      integer which maps to a safe configuration to use when the interrupt
+      controller irq is unused.
+    default: 0
+
+required:
+  - compatible
+  - reg
+  - interrupt-controller
+  - '#interrupt-cells'
+  - ti,max-irqs
+  - ti,max-crossbar-sources
+  - ti,reg-size
+  - ti,crossbar-irqs-reserved
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/interrupt-controller/arm-gic.h>
+
+    crossbar_mpu: crossbar@4a002a48 {
+        compatible = "ti,irq-crossbar";
+        reg = <0x4a002a48 0x130>;
+        interrupt-controller;
+        #interrupt-cells = <3>;
+        ti,max-irqs = <160>;
+        ti,max-crossbar-sources = <400>;
+        ti,reg-size = <2>;
+        ti,crossbar-irqs-reserved = <0 1 2 3 5 6 131 132>;
+        ti,irqs-skip = <10 133 139 140>;
+    };

-- 
2.54.0

[PATCH 2/3] irqchip: irq-crossbar: Handle renamed irqs-reserved property

[Bhargav Joshi]

The DT binding for the TI IRQ Crossbar has been converted from text to
YAML schema. As part of that conversion, 'ti,irqs-reserved' was renamed
to 'ti,crossbar-irqs-reserved' to avoid a property name collision with
ti,pruss-intc.yaml

Update the driver to try the new property name first and fall back to
the old name ensuring compatibility with older device trees.

Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
---
 drivers/irqchip/irq-crossbar.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index cd1134101ace..64b042ce11a9 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -5,6 +5,7 @@
  *  Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com
  *  Author: Sricharan R <r.sricharan@ti.com>
  */
+#include "linux/of.h"
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irqchip.h>
@@ -197,6 +198,7 @@ static int __init crossbar_of_init(struct device_node *node)
 	u32 max = 0, entry, reg_size;
 	int i, size, reserved = 0;
 	const __be32 *irqsr;
+	const char *pname;
 	int ret = -ENOMEM;
 
 	cb = kzalloc_obj(*cb);
@@ -231,14 +233,21 @@ static int __init crossbar_of_init(struct device_node *node)
 	for (i = 0; i < max; i++)
 		cb->irq_map[i] = IRQ_FREE;
 
-	/* Get and mark reserved irqs */
-	irqsr = of_get_property(node, "ti,irqs-reserved", &size);
+	/*
+	 * Get and mark reserved irqs
+	 * try new property name first, fall back to old name for compatibility
+	 * on older device trees.
+	 */
+	pname = of_property_present(node, "ti,crossbar-irqs-reserved") ?
+		"ti,crossbar-irqs-reserved" : "ti,irqs-reserved";
+
+	irqsr = of_get_property(node, pname, &size);
 	if (irqsr) {
 		size /= sizeof(__be32);
 
 		for (i = 0; i < size; i++) {
 			of_property_read_u32_index(node,
-						   "ti,irqs-reserved",
+						   pname,
 						   i, &entry);
 			if (entry >= max) {
 				pr_err("Invalid reserved entry\n");

-- 
2.54.0

[PATCH 3/3] ARM: dts: omap: dra7: Use new property name ti,crossbar-irqs-reserved

[Bhargav Joshi]

Property name for irq-crossbar 'ti,irqs-reserved' is updated to
'ti,crossbar-irqs-reserved' by new binding conversion.

Update the crossbar node in dra7.dtsi to use the new property name.
since driver accepts both new and old name this is non-functional
change.

Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
---
 arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/dra7.dtsi b/arch/arm/boot/dts/ti/omap/dra7.dtsi
index 711ce4c31bb1..80bee3db3a53 100644
--- a/arch/arm/boot/dts/ti/omap/dra7.dtsi
+++ b/arch/arm/boot/dts/ti/omap/dra7.dtsi
@@ -866,7 +866,7 @@ crossbar_mpu: crossbar@4a002a48 {
 			ti,max-irqs = <160>;
 			ti,max-crossbar-sources = <MAX_SOURCES>;
 			ti,reg-size = <2>;
-			ti,irqs-reserved = <0 1 2 3 5 6 131 132>;
+			ti,crossbar-irqs-reserved = <0 1 2 3 5 6 131 132>;
 			ti,irqs-skip = <10 133 139 140>;
 			ti,irqs-safe-map = <0>;
 		};

-- 
2.54.0

Re: [PATCH 2/3] irqchip: irq-crossbar: Handle renamed irqs-reserved property

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch uses double quotes for including a system kernel header (`#include "linux/of.h"`) instead of angle brackets (`#include <linux/of.h>`).
--

commit 45bcc0524f9b113a66a6033e639fbb294bcfc7da
Author: Bhargav Joshi <j.bhargav.u@gmail.com>

irqchip: irq-crossbar: Handle renamed irqs-reserved property

This commit updates the TI IRQ Crossbar driver to handle a renamed device
tree property. It tries ti,crossbar-irqs-reserved first and falls back to
ti,irqs-reserved to maintain backward compatibility with older device trees.

> diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
> index cd1134101ace0..64b042ce11a9a 100644
> --- a/drivers/irqchip/irq-crossbar.c
> +++ b/drivers/irqchip/irq-crossbar.c
> @@ -5,6 +5,7 @@
>   *  Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com
>   *  Author: Sricharan R <r.sricharan@ti.com>
>   */
> +#include "linux/of.h"

[Severity: Low]
This isn't a bug, but looking at the global includes in
drivers/irqchip/irq-crossbar.c, should this include use angle brackets
instead of double quotes? Standard kernel coding style expects <linux/of.h>
for system headers, as using double quotes forces the preprocessor to search
the local directory first.

>  #include <linux/err.h>
>  #include <linux/io.h>
>  #include <linux/irqchip.h>

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606-crossbar-v1-0-f67f7cb9ee50@gmail.com?part=2

Re: [PATCH 3/3] ARM: dts: omap: dra7: Use new property name ti,crossbar-irqs-reserved

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] crossbar_domain_free() uses the crossbar source index (d->hwirq) to index into the GIC SPI array (cb->irq_map) and register offsets array, causing an out-of-bounds write and hardware misconfiguration.
- [High] allocate_gic_irq() modifies cb->irq_map[i] on its error path without holding the required cb->lock.
--

commit 8a92634d55db2a355eaab894b32aa94e0464f39a
Author: Bhargav Joshi <j.bhargav.u@gmail.com>

ARM: dts: omap: dra7: Use new property name ti,crossbar-irqs-reserved
    
Property name for irq-crossbar 'ti,irqs-reserved' is updated to
'ti,crossbar-irqs-reserved' by new binding conversion.

> diff --git a/arch/arm/boot/dts/ti/omap/dra7.dtsi b/arch/arm/boot/dts/ti/omap/dra7.dtsi
> index 711ce4c31bb1f..80bee3db3a532 100644
> --- a/arch/arm/boot/dts/ti/omap/dra7.dtsi
> +++ b/arch/arm/boot/dts/ti/omap/dra7.dtsi
> @@ -866,7 +866,7 @@ crossbar_mpu: crossbar@4a002a48 {
>  			ti,max-irqs = <160>;
>  			ti,max-crossbar-sources = <MAX_SOURCES>;
>  			ti,reg-size = <2>;
> -			ti,irqs-reserved = <0 1 2 3 5 6 131 132>;
> +			ti,crossbar-irqs-reserved = <0 1 2 3 5 6 131 132>;
>  			ti,irqs-skip = <10 133 139 140>;
>  			ti,irqs-safe-map = <0>;
>  		};

While reviewing this patch, I noticed a couple of pre-existing issues in
drivers/irqchip/irq-crossbar.c:

drivers/irqchip/irq-crossbar.c
>  static int allocate_gic_irq(struct irq_domain *domain, unsigned int virq,
>                              irq_hw_number_t hwirq)
>  {
[ ... ]
>  	raw_spin_lock(&cb->lock);
>  	for (i = cb->int_max - 1; i >= 0; i--) {
>  		if (cb->irq_map[i] == IRQ_FREE) {
>  			cb->irq_map[i] = hwirq;
>  			break;
>  		}
>  	}
>  	raw_spin_unlock(&cb->lock);
>  
>  	if (i < 0)
>  		return -ENODEV;
[ ... ]
>  	err = irq_domain_alloc_irqs_parent(domain, virq, 1, &fwspec);
>  	if (err)
>  		cb->irq_map[i] = IRQ_FREE;

[Severity: High]
This is a pre-existing issue, but does this error path modify cb->irq_map[i]
without holding cb->lock?

Earlier in the function, cb->lock is acquired to protect accesses to the
shared cb->irq_map array. Resetting cb->irq_map[i] to IRQ_FREE here without
re-acquiring the lock appears to create a data race with concurrent
allocations or frees on other CPUs.

>  	else
>  		cb->write(i, hwirq);
>  
>  	return err;
>  }

[ ... ]

>  static void crossbar_domain_free(struct irq_domain *domain, unsigned int virq,
>  				 unsigned int nr_irqs)
>  {
>  	int i;
>  
>  	raw_spin_lock(&cb->lock);
>  	for (i = 0; i < nr_irqs; i++) {
>  		struct irq_data *d = irq_domain_get_irq_data(domain, virq + i);
>  
>  		irq_domain_reset_irq_data(d);
>  		cb->irq_map[d->hwirq] = IRQ_FREE;
>  		cb->write(d->hwirq, cb->safe_map);

[Severity: Critical]
This is a pre-existing issue, but does crossbar_domain_free() use the wrong
index when freeing the map?

In allocate_gic_irq(), the allocated GIC SPI index 'i' (bounded by
cb->int_max = 160) is used to index cb->irq_map and cb->register_offsets,
while the crossbar source index 'hwirq' (bounded by
cb->max_crossbar_sources = 400) is stored as the value.

Here, crossbar_domain_free() uses 'd->hwirq' (the crossbar source index) as
the index for cb->irq_map and cb->write(), rather than the GIC SPI index.
Since the source index can greatly exceed the bounds of the array, could
this lead to out-of-bounds memory writes and out-of-bounds MMIO writes to
hardware registers?

>  	}
>  	raw_spin_unlock(&cb->lock);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606-crossbar-v1-0-f67f7cb9ee50@gmail.com?part=3