[PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema

[PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema

[Eduard Bostina]

Convert the Texas Instruments TPS61050/TPS61052 boost converters bindings
to DT schema.

Signed-off-by: Eduard Bostina <egbostina@gmail.com>
---
 .../devicetree/bindings/mfd/ti,tps61050.yaml  | 92 +++++++++++++++++++
 .../devicetree/bindings/mfd/tps6105x.txt      | 62 -------------
 2 files changed, 92 insertions(+), 62 deletions(-)
 create mode 100644 Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
 delete mode 100644 Documentation/devicetree/bindings/mfd/tps6105x.txt

diff --git a/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
new file mode 100644
index 000000000000..974ef78d6e26
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/mfd/ti,tps61050.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Texas Instruments TPS61050/TPS61052 Boost Converter
+
+maintainers:
+  - Eduard Bostina <egbostina@gmail.com>
+
+description:
+  The TP61050/TPS61052 is a high-power "white LED driver". The device
+  provides LED, GPIO and regulator functionalities.
+
+properties:
+  compatible:
+    enum:
+      - ti,tps61050
+      - ti,tps61052
+
+  reg:
+    maxItems: 1
+
+  regulator:
+    type: object
+    $ref: /schemas/regulator/regulator.yaml#
+    description: Puts the chip in regulator mode.
+    unevaluatedProperties: false
+
+  led:
+    type: object
+    $ref: /schemas/leds/common.yaml#
+    description: Puts the chip in LED mode.
+    unevaluatedProperties: false
+
+required:
+  - compatible
+  - reg
+
+allOf:
+  - not:
+      required:
+        - regulator
+        - led
+
+additionalProperties: false
+
+examples:
+  - |
+    i2c {
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        tps61052@33 {
+            compatible = "ti,tps61052";
+            reg = <0x33>;
+        };
+    };
+
+  - |
+    i2c {
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        tps61052@33 {
+            compatible = "ti,tps61052";
+            reg = <0x33>;
+
+            regulator {
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-always-on;
+            };
+        };
+    };
+
+  - |
+    #include <dt-bindings/leds/common.h>
+    i2c {
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        tps61052@33 {
+            compatible = "ti,tps61052";
+            reg = <0x33>;
+
+            led {
+                color = <LED_COLOR_ID_WHITE>;
+            };
+        };
+    };
diff --git a/Documentation/devicetree/bindings/mfd/tps6105x.txt b/Documentation/devicetree/bindings/mfd/tps6105x.txt
deleted file mode 100644
index dc448a9d5b4d..000000000000
--- a/Documentation/devicetree/bindings/mfd/tps6105x.txt
+++ /dev/null
@@ -1,62 +0,0 @@
-* Device tree bindings for TI TPS61050/61052 Boost Converters
-
-The TP61050/TPS61052 is a high-power "white LED driver". The
-device provides LED, GPIO and regulator functionalities.
-
-Required properties:
-- compatible:		"ti,tps61050" or "ti,tps61052"
-- reg:			Specifies the I2C slave address
-
-Optional sub-node:
-
-This subnode selects the chip's operational mode.
-There can be at most one single available subnode.
-
-- regulator: presence of this sub-node puts the chip in regulator mode.
-	see ../regulator/regulator.yaml
-
-- led: presence of this sub-node puts the chip in led mode.
-	Optional properties:
-	- function : see ../leds/common.txt
-	- color    : see ../leds/common.txt
-	- label    : see ../leds/common.txt
-			(deprecated)
-
-Example (GPIO operation only):
-
-i2c0 {
-	tps61052@33 {
-		compatible = "ti,tps61052";
-		reg = <0x33>;
-	};
-};
-
-Example (GPIO + regulator operation):
-
-i2c0 {
-	tps61052@33 {
-		compatible = "ti,tps61052";
-		reg = <0x33>;
-
-		regulator {
-			regulator-min-microvolt = <5000000>;
-			regulator-max-microvolt = <5000000>;
-			regulator-always-on;
-		};
-	};
-};
-
-Example (GPIO + led operation):
-
-#include <dt-bindings/leds/common.h>
-
-i2c0 {
-	tps61052@33 {
-		compatible = "ti,tps61052";
-		reg = <0x33>;
-
-		led {
-			color = <LED_COLOR_ID_WHITE>;
-		};
-	};
-};
-- 
2.43.0

Re: [PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The MFD core driver dynamically mutates static `mfd_cell` structures to pass custom parent data via `platform_data`, violating MFD guidelines and introducing a race condition.
--

--- Patch [1]: [PATCH] dt-bindings: mfd: Convert TPS61050 to DT schema ---
commit c3b0af0c4f22b90e8d39db54cb33489eff5b078e
Author: Eduard Bostina <egbostina@gmail.com>

dt-bindings: mfd: Convert TPS61050 to DT schema
    
Convert the Texas Instruments TPS61050/TPS61052 boost converters bindings
to DT schema.

> diff --git a/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
> new file mode 100644
> index 0000000000000..974ef78d6e26e
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/mfd/ti,tps61050.yaml
> @@ -0,0 +1,92 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/mfd/ti,tps61050.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Texas Instruments TPS61050/TPS61052 Boost Converter

[Severity: High]
This isn't a bug introduced by this patch, but the core driver for these
devices dynamically mutates static mfd_cell structures.

Looking at tps6105x_add_device() in drivers/mfd/tps6105x.c, the function
modifies the shared static mfd_cell's platform_data field with a pointer to
the newly allocated parent data:

drivers/mfd/tps6105x.c:tps6105x_add_device() {
    ...
	cell->platform_data = tps6105x;
	cell->pdata_size = sizeof(*tps6105x);
    ...
}

Because the cell is declared as static but not const:

drivers/mfd/tps6105x.c:
static struct mfd_cell tps6105x_gpio_cell = {
	.name = "tps6105x-gpio",
};

Could this create a data race if multiple I2C adapter initialization threads
concurrently call tps6105x_probe()?

Additionally, the child driver incorrectly reads the duplicated platform_data
instead of using dev_get_drvdata() on the parent device as mandated by MFD
rules:

drivers/leds/leds-tps6105x.c:tps6105x_led_probe() {
    ...
	struct tps6105x *tps6105x = dev_get_platdata(&pdev->dev);
    ...
}

Because platform_device_add_data() makes a kmemdup copy of the struct passed
via platform_data, if device B unbinds, device A's child may hold a copy of
pointers that were freed, leading to a Use-After-Free.

Could the child driver be updated to retrieve parent data via
dev_get_drvdata(pdev->dev.parent), allowing the mfd_cell arrays to be static
const?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260815083145.2145984-1-egbostina@gmail.com?part=1