[PATCH v2 0/3] ARM: dts: imx: cleanup st,stmpe touch screen related CHECK_DTB warings

[PATCH v2 0/3] ARM: dts: imx: cleanup st,stmpe touch screen related CHECK_DTB warings

[Frank.Li]

cleanup st,stmpe touch screen related CHECK_DTB warings.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
Changes in v2:
- rebase to v7.3-rc1
- collect review-by tags
- move more irq-trigger in dts
- Link to v1: https://patch.msgid.link/20260708-dts-stmpe-v1-0-1f51d15bb358@nxp.com

---
Frank Li (3):
      dt-bindings: mfd: st,stmpe: add deprecated properties
      dt-bindings: mfd: st,stmpe: let interrupt property optional
      ARM: dts: imx: remove undocument properties of st,stmpe*

 .../devicetree/bindings/mfd/st,stmpe.yaml          | 25 +++++++++++++++++++++-
 arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi           |  3 ---
 arch/arm/boot/dts/nxp/imx/imx6q-novena.dts         |  3 ---
 arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi      |  3 ---
 arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi     |  3 ---
 5 files changed, 24 insertions(+), 13 deletions(-)
---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260708-dts-stmpe-98597a66fab1

Best regards,
--  
Frank Li <Frank.Li@nxp.com>

[PATCH v2 1/3] dt-bindings: mfd: st,stmpe: add deprecated properties

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Add deprecated properties st,sample-time, st,sample-time, st,mod-12b and
st,ref-sel. The both driver drivers/mfd/stmpe.c and
drivers/input/touchscreen/stmpe-ts.c parse these information. Some dts
put these properties under mfd, but some put these under child node
sample_ts.

Allow these properties put under sample_ts and mark as deprecated to fix
below CHECK_DTBS warnings:
  arch/arm/boot/dts/nxp/imx/imx6q-novena.dtb: stmpe811@44 (st,stmpe811): touchscreen: Unevaluated properties are not allowed ('st,adc-freq', 'st,mod-12b', 'st,ref-sel', 'st,sample-time' were unexpected)
        from schema $id: http://devicetree.org/schemas/mfd/st,stmpe.yaml

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 .../devicetree/bindings/mfd/st,stmpe.yaml          | 24 ++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
index ddb27ae64ba37..592e8f17659f3 100644
--- a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
+++ b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
@@ -141,6 +141,30 @@ properties:
       compatible:
         const: st,stmpe-ts
 
+      st,sample-time:
+        $ref: /schemas/types.yaml#/definitions/uint32
+        enum: [ 0, 1, 2, 3, 4, 5, 6 ]
+        deprecated: true
+        description: See top layer st,sample-time.
+
+      st,mod-12b:
+        $ref: /schemas/types.yaml#/definitions/uint32
+        enum: [ 0, 1 ]
+        deprecated: true
+        description: See top layer st,mod-12b
+
+      st,ref-sel:
+        $ref: /schemas/types.yaml#/definitions/uint32
+        enum: [ 0, 1 ]
+        deprecated: true
+        description: See top layer st,ref-sel
+
+      st,adc-freq:
+        $ref: /schemas/types.yaml#/definitions/uint32
+        enum: [ 0, 1, 2, 3 ]
+        deprecated: true
+        description: See top layer st,adc-freq
+
       st,ave-ctrl:
         $ref: /schemas/types.yaml#/definitions/uint32
         enum: [ 0, 1, 2, 3 ]

-- 
2.43.0

Re: [PATCH v2 1/3] dt-bindings: mfd: st,stmpe: add deprecated properties

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

New issues:
- [Low] The commit message description is not capitalized, violating the MFD subsystem naming conventions.

Pre-existing issues:
- [High] Incorrect teardown order in the MFD core driver causes use-after-disable and illegal IRQ domain removal.
- [High] Interrupt is requested before hardware is initialized in the touchscreen probe.
- [High] Missing manual `input_unregister_device()` in `stmpe_ts_remove()` causes the driver to access disabled hardware during input device unregistration.
--

commit 2b78324bb3bbfce531df8a18d620cea4c9246016
Author: Frank Li <Frank.Li@nxp.com>

dt-bindings: mfd: st,stmpe: add deprecated properties

This commit adds deprecated properties st,sample-time, st,mod-12b,
st,ref-sel, and st,adc-freq to the st,stmpe-ts child node. This resolves
CHECK_DTBS warnings for devicetrees that place these properties under
the sample_ts node instead of the parent MFD node.

> dt-bindings: mfd: st,stmpe: add deprecated properties

[Severity: Low]
Does the description "add deprecated properties" follow the MFD subsystem
naming conventions? The guidelines specify that the description after the
subsystem prefix should always be capitalized.

> diff --git a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
> index ddb27ae64ba37..592e8f17659f3 100644
> --- a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
> +++ b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
> @@ -141,6 +141,30 @@ properties:
>        compatible:
>          const: st,stmpe-ts
>  
> +      st,sample-time:
> +        $ref: /schemas/types.yaml#/definitions/uint32
> +        enum: [ 0, 1, 2, 3, 4, 5, 6 ]
> +        deprecated: true
> +        description: See top layer st,sample-time.
> +
> +      st,mod-12b:
> +        $ref: /schemas/types.yaml#/definitions/uint32
> +        enum: [ 0, 1 ]
> +        deprecated: true
> +        description: See top layer st,mod-12b
> +
> +      st,ref-sel:
> +        $ref: /schemas/types.yaml#/definitions/uint32
> +        enum: [ 0, 1 ]
> +        deprecated: true
> +        description: See top layer st,ref-sel
> +
> +      st,adc-freq:
> +        $ref: /schemas/types.yaml#/definitions/uint32
> +        enum: [ 0, 1, 2, 3 ]
> +        deprecated: true
> +        description: See top layer st,adc-freq
> +
>        st,ave-ctrl:
>          $ref: /schemas/types.yaml#/definitions/uint32
>          enum: [ 0, 1, 2, 3 ]

While reviewing this patch, I noticed a few pre-existing issues in the related
C drivers that might warrant a look.

drivers/mfd/stmpe.c:stmpe_remove() {
	if (stmpe->domain)
		irq_domain_remove(stmpe->domain);

	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
		regulator_disable(stmpe->vio);
	...
	__stmpe_disable(stmpe, STMPE_BLOCK_ADC);

	mfd_remove_devices(stmpe->dev);
}

[Severity: High]
This isn't a bug introduced by this patch, but does this teardown sequence
cause a use-after-disable or illegal IRQ domain removal? Since the core
resources, IRQ domains, and power are disabled before mfd_remove_devices()
is called, won't the child drivers attempt to manage IRQs and communicate
with unpowered hardware when their remove() callbacks execute?


drivers/input/touchscreen/stmpe-ts.c:stmpe_input_probe() {
	error = devm_request_threaded_irq(&pdev->dev, ts_irq,
					  NULL, stmpe_ts_handler,
					  IRQF_ONESHOT, STMPE_TS_NAME, ts);
	if (error) {
		...
	}

	error = stmpe_init_hw(ts);
}

[Severity: High]
This is a pre-existing issue, but is it safe to request the IRQ before
the hardware is fully initialized? Could a spurious or pending interrupt
trigger the handler on uninitialized or disabled hardware, potentially
leading to bus errors or hangs when the handler attempts to read registers?


drivers/input/touchscreen/stmpe-ts.c:stmpe_ts_remove() {
	stmpe_disable(ts->stmpe, STMPE_BLOCK_TOUCHSCREEN);
}

[Severity: High]
This isn't a bug introduced by this patch, but does manually disabling the
touchscreen block here bypass the devres lifecycle dependency order? 

Because the managed input device and IRQ are cleaned up later by devres,
does this cause the input device's close callback to execute after the
hardware is disabled?

drivers/input/touchscreen/stmpe-ts.c:stmpe_ts_close() {
	stmpe_set_bits(ts->stmpe, STMPE_REG_TSC_CTRL,
			STMPE_TSC_CTRL_TSC_EN, 0);
}

Could this out-of-order cleanup lead to illegal I2C writes to the disabled
hardware block?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-dts-stmpe-v2-0-f93d5f080443@nxp.com?part=1

[PATCH v2 2/3] dt-bindings: mfd: st,stmpe: let interrupt property optional

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Not all boards connect irq lines. So mark interrupt property optional.

Fix below CHECK_DTBS warnings:
  arch/arm/boot/dts/nxp/imx/imx6dl-phytec-pbab01.dtb: stmpe@41 (st,stmpe811): 'oneOf' conditional failed, one must be fixed:
        'interrupts' is a required property
        'interrupts-extended' is a required property

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 Documentation/devicetree/bindings/mfd/st,stmpe.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
index 592e8f17659f3..6fde068b526a0 100644
--- a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
+++ b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
@@ -225,7 +225,6 @@ additionalProperties: false
 required:
   - compatible
   - reg
-  - interrupts
 
 examples:
   - |

-- 
2.43.0

Re: [PATCH v2 2/3] dt-bindings: mfd: st,stmpe: let interrupt property optional

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

New issues:
- [Low] The commit message description is not capitalized, violating MFD subsystem guidelines.

Pre-existing issues:
- [High] The driver explicitly breaks `interrupts-extended` DT bindings by manually checking for the literal "interrupts" string and overriding the valid IRQ with -1 if missing.
- [High] Global static structures `i2c_ci` and `spi_ci` are mutated concurrently during probe, leading to data races if multiple devices probe simultaneously.
- [High] Memory and resource leaks exist on error paths in `stmpe_probe` for manually enabled regulators and the dynamically created IRQ domain, leading to a Use-After-Free.
- [High] The driver modifies global shared `mfd_cell` resource arrays at runtime by casting away `const`, leading to race conditions and corrupted IRQ assignments.
--

commit 5a672301bc93caad7ec80c8b4ff3ebf32574e530
Author: Frank Li <Frank.Li@nxp.com>
Subject: dt-bindings: mfd: st,stmpe: let interrupt property optional

This commit updates the device tree binding for the st,stmpe MFD to make
the interrupts property optional. It addresses configurations where not all
boards connect IRQ lines, fixing validation warnings reported by dtbs_check.

> dt-bindings: mfd: st,stmpe: let interrupt property optional

[Severity: Low]
Is the capitalization correct here? MFD subsystem guidelines require
capitalizing the description after the subsystem prefix.

> diff --git a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
> index 592e8f17659f3..6fde068b526a0 100644
> --- a/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
> +++ b/Documentation/devicetree/bindings/mfd/st,stmpe.yaml
[ ... ]
> @@ -225,7 +225,6 @@ additionalProperties: false
>  required:
>    - compatible
>    - reg
> -  - interrupts
>  
>  examples:
>    - |

While reviewing the interrupt changes, I noticed a few pre-existing
issues in the stmpe driver that might need addressing.

In drivers/mfd/stmpe.c:stmpe_probe():

	stmpe_of_probe(pdata, np);

	if (!of_property_present(np, "interrupts"))
		ci->irq = -1;

	stmpe = devm_kzalloc(ci->dev, sizeof(struct stmpe), GFP_KERNEL);

[Severity: High]
This is a pre-existing issue, but does this logic break the standard
interrupts-extended DT binding? 

If a device tree uses interrupts-extended instead of interrupts, it seems
of_property_present() will erroneously clobber the valid ci->irq to -1, causing
the probe to fail with -ENODEV or fallback to polling.

Also in drivers/mfd/stmpe.c:stmpe_probe():

	if (stmpe->irq >= 0) {
		ret = stmpe_irq_init(stmpe, np);
		if (ret)
			return ret;

		ret = devm_request_threaded_irq(ci->dev, stmpe->irq, NULL,
				stmpe_irq, pdata->irq_trigger | IRQF_ONESHOT,
				"stmpe", stmpe);
		if (ret) {
			dev_err(stmpe->dev, "failed to request IRQ: %d\n",
					ret);
			return ret;
		}
	}

	ret = stmpe_devices_init(stmpe);
	if (!ret)
		return 0;

	dev_err(stmpe->dev, "failed to add children\n");
	mfd_remove_devices(stmpe->dev);

	return ret;

[Severity: High]
This is a pre-existing issue, but are the dynamically created irq_domain
and enabled regulators leaked on these error paths? 

If probe fails after stmpe_irq_init(), returning directly without cleanup
might leave the leaked irq_domain host_data pointing to the devm-freed
stmpe struct, potentially creating a use-after-free condition.

In drivers/mfd/stmpe-i2c.c:stmpe_i2c_probe():

	i2c_ci.data = (void *)id;
	i2c_ci.irq = i2c->irq;
	i2c_ci.client = i2c;
	i2c_ci.dev = &i2c->dev;

And similarly in drivers/mfd/stmpe-spi.c:stmpe_spi_probe():

	spi_ci.irq = spi->irq;
	spi_ci.client = spi;
	spi_ci.dev = &spi->dev;

[Severity: High]
This is a pre-existing issue, but could mutating the global static structures
i2c_ci and spi_ci concurrently during probe cause data races? 

If multiple STMPE devices probe simultaneously, operations like transfers
might be routed to the wrong device or freed on the wrong unbind due to the
dev and client pointers pointing to the incorrect instance.

Finally, in drivers/mfd/stmpe.c:stmpe_devices_init():

		for (j = 0; j < block->cell->num_resources; j++) {
			struct resource *res =
				(struct resource *) &block->cell->resources[j];

			/* Dynamically fill in a variant's IRQ. */
			if (res->flags & IORESOURCE_IRQ)
				res->start = res->end = block->irq + j;
		}

[Severity: High]
This is a pre-existing issue, but is it safe to cast away the const qualifier
on the global mfd_cell resource arrays here? 

Dynamically modifying this shared state could allow concurrent IRQ writes from
multiple probing instances to overwrite each other, potentially corrupting
IRQ assignments across the system.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-dts-stmpe-v2-0-f93d5f080443@nxp.com?part=2

[PATCH v2 3/3] ARM: dts: imx: remove undocument properties of st,stmpe*

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>

Remove undocument properties irq-trigger, id, blocks of st,stmp* to fix
below CHECK_DTBS warnings:
  arch/arm/boot/dts/nxp/imx/imx6q-apalis-eval.dtb: stmpe811@41 (st,stmpe811): 'blocks', 'id', 'irq-trigger' do not match any of the regexes: '^pinctrl-[0-9]+$'
        from schema $id: http://devicetree.org/schemas/mfd/st,stmpe.yaml

Known other user (uboot) doesn't support this touch screen device.

Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi       | 3 ---
 arch/arm/boot/dts/nxp/imx/imx6q-novena.dts     | 3 ---
 arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi  | 3 ---
 arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi | 3 ---
 4 files changed, 12 deletions(-)

diff --git a/arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi b/arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi
index 89b17509ad487..9f7548e87f6ca 100644
--- a/arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi
+++ b/arch/arm/boot/dts/nxp/imx/imx53-m53.dtsi
@@ -41,11 +41,8 @@ &i2c2 {
 	touchscreen@41 {
 		compatible = "st,stmpe610";
 		reg = <0x41>;
-		id = <0>;
-		blocks = <0x5>;
 		interrupts = <6 0x0>;
 		interrupt-parent = <&gpio7>;
-		irq-trigger = <0x1>;
 
 		touchscreen {
 			compatible = "st,stmpe-ts";
diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-novena.dts b/arch/arm/boot/dts/nxp/imx/imx6q-novena.dts
index cd9a050fa906e..9938a63b5110c 100644
--- a/arch/arm/boot/dts/nxp/imx/imx6q-novena.dts
+++ b/arch/arm/boot/dts/nxp/imx/imx6q-novena.dts
@@ -281,9 +281,6 @@ touch: stmpe811@44 {
 		compatible = "st,stmpe811";
 		reg = <0x44>;
 		irq-gpio = <&gpio5 13 GPIO_ACTIVE_HIGH>;
-		id = <0>;
-		blocks = <0x5>;
-		irq-trigger = <0x1>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_stmpe_novena>;
 		vio-supply = <&reg_3p3v>;
diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi
index 5fcd7cdb7001f..af038ac472261 100644
--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi
+++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi
@@ -631,11 +631,8 @@ codec: sgtl5000@a {
 	/* STMPE811 touch screen controller */
 	stmpe811@41 {
 		compatible = "st,stmpe811";
-		blocks = <0x5>;
-		id = <0>;
 		interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
 		interrupt-parent = <&gpio4>;
-		irq-trigger = <0x1>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_touch_int>;
 		reg = <0x41>;
diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi
index 8a0ce250e5760..c9e539f83f80f 100644
--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi
+++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi
@@ -555,11 +555,8 @@ codec: sgtl5000@a {
 	/* STMPE811 touch screen controller */
 	stmpe811@41 {
 		compatible = "st,stmpe811";
-		blocks = <0x5>;
 		interrupts = <20 IRQ_TYPE_LEVEL_LOW>;
 		interrupt-parent = <&gpio6>;
-		id = <0>;
-		irq-trigger = <0x1>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_touch_int>;
 		reg = <0x41>;

-- 
2.43.0