linux-stable.git/drivers/of, branch master

Merge tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-06-17T18:54:57+00:00

Pull devicetree updates from Rob Herring:
 "DT core:

   - Add support for handling multiple cells in "iommu-map" entries

   - Support only 1 entry in /reserved-memory "reg" entries. Support for
     more than 1 entry has been broken

   - Fix a UAF on alloc_reserved_mem_array() failure

   - Make "ibm,phandle" handling logic specific to PPC

   - Use memcpy() instead of strcpy() for known length strings

   - Ensure __of_find_n_match_cpu_property() handles malformed "reg"
     entries

   - Add various checks that expected strings are strings before
     accessing them

   - Drop redundant memset() when unflattening DT

  DT bindings:

   - Add a DTS style checker. Currently hooked up to dt_binding_check to
     check examples

   - Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar
     bindings to DT schema

   - Add Apple System Management Controller hwmon, Qualcomm Hamoa
     Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323,
     Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder,
     Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas

   - Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc,
     qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys

   - Consolidate "sram" property definitions

   - Fix constraints on "nvmem" properties which only contain phandles
     and no arg cells

   - Another pass of fixing "phandle-array" constraints

   - Add Gira vendor prefix"

* tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits)
  dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string
  dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema
  dt-bindings: vendor-prefixes: add Gira
  dt-bindings: embedded-controller: Add Qualcomm reference device EC description
  dt-bindings: pwm: add IPQ6018 binding
  dt-bindings: hwmon: Add Apple System Management Controller hwmon schema
  docs: dt: writing-schema: Clarify what is required in a schema
  of: Respect #{iommu,msi}-cells in maps
  of: Factor arguments passed to of_map_id() into a struct
  of: Add convenience wrappers for of_map_id()
  of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry
  of: reserved_mem: handle NULL name in of_reserved_mem_lookup()
  dt-bindings: cache: l2c2x0: Add missing power-domains
  dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example
  dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries
  drivers/of/overlay: Use memcpy() to copy known length strings
  dt-bindings: add self-test fixtures for style checker
  dt-bindings: wire style checker into dt_binding_check
  scripts/jobserver-exec: propagate child exit status
  dt-bindings: add DTS style checker
  ...

of: Respect #{iommu,msi}-cells in maps

2026-06-12T15:25:39+00:00

So far our parsing of {iommu,msi}-map properties has always blindly
assumed that the output specifiers will always have exactly 1 cell.
This typically does happen to be the case, but is not actually enforced
(and the PCI msi-map binding even explicitly states support for 0 or 1
cells) - as a result we've now ended up with dodgy DTs out in the field
which depend on this behaviour to map a 1-cell specifier for a 2-cell
provider, despite that being bogus per the bindings themselves.

Since there is some potential use in being able to map at least single
input IDs to multi-cell output specifiers (and properly support 0-cell
outputs as well), add support for properly parsing and using the target
nodes' #cells values, albeit with the unfortunate complication of still
having to work around expectations of the old behaviour too.

Since there are multi-cell output specifiers, the callers of of_map_id()
may need to get the exact cell output value for further processing.
Update of_map_id() to set args_count in the output to reflect the actual
number of output specifier cells.

Signed-off-by: Robin Murphy 
Signed-off-by: Charan Teja Kalla 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-3-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: Factor arguments passed to of_map_id() into a struct

2026-06-12T15:25:39+00:00

Change of_map_id() to take a pointer to struct of_phandle_args
instead of passing target device node and translated IDs separately.
Update all callers accordingly.

Add an explicit filter_np parameter to of_map_id() and of_map_msi_id()
to separate the filter input from the output. Previously, the target
parameter served dual purpose: as an input filter (if non-NULL, only
match entries targeting that node) and as an output (receiving the
matched node with a reference held). Now filter_np is the explicit
input filter and arg->np is the pure output.

Previously, of_map_id() would call of_node_put() on the matched node
when a filter was provided, making reference ownership inconsistent.
Remove this internal of_node_put() call so that of_map_id() now always
transfers ownership of the matched node reference to the caller via
arg->np. Callers are now consistently responsible for releasing this
reference with of_node_put(arg->np) when done.

Acked-by: Frank Li 
Suggested-by: Rob Herring (Arm) 
Suggested-by: Dmitry Baryshkov 
Signed-off-by: Charan Teja Kalla 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: Add convenience wrappers for of_map_id()

2026-06-12T15:25:39+00:00

Since we now have quite a few users parsing "iommu-map" and "msi-map"
properties, give them some wrappers to conveniently encapsulate the
appropriate sets of property names. This will also make it easier to
then change of_map_id() to correctly account for specifier cells.

Reviewed-by: Rob Herring (Arm) 
Reviewed-by: Frank Li 
Acked-by: Marc Zyngier 
Acked-by: Bjorn Helgaas 
Signed-off-by: Robin Murphy 
Signed-off-by: Vijayanand Jitta 
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm)

of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry

2026-06-12T14:36:37+00:00

Prepare for storing /memreserve/ entries in the reserved_mem array.
Zero total_reserved_mem_cnt if no valid /reserved-memory entry,
instead of keeping it's initial value of MAX_RESERVED_REGIONS, this
allows accounting /memreserve entries based on total_reserved_mem_cnt
in a follow-up patch.

No functional change.

Signed-off-by: Wandun Chen 
Link: https://patch.msgid.link/20260527032917.3385849-5-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm)

of: reserved_mem: handle NULL name in of_reserved_mem_lookup()

2026-06-12T14:36:18+00:00

Prepare for an upcoming change that appends /memreserve/ entries to
reserved_mem[]; such entries have no name.

No functional change.

Signed-off-by: Wandun Chen 
Link: https://patch.msgid.link/20260527032917.3385849-2-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm)

drivers/of/overlay: Use memcpy() to copy known length strings

2026-06-10T18:48:40+00:00

Avoid calls to strcpy().
The lengths of the strings have been used for the kzalloc(), replace
the strcpy() calls with memcpy() using the known lengths.

Signed-off-by: David Laight 
Link: https://patch.msgid.link/20260608185121.22331-1-david.laight.linux@gmail.com
Signed-off-by: Rob Herring (Arm)

of: cpu: add check in __of_find_n_match_cpu_property()

2026-06-10T18:26:53+00:00

In __of_find_n_match_cpu_property(), checking the variable ac for 0 won't
prevent a possible overflow when multiplying it by sizeof(*cell). Besides,
of_read_number() (called in the *for* loop) can't return correct result if
that variable (which equals the #address-cells prop's value) exceeds 2, so
additionally checking for that seems logical...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: f3cea45a77c8 ("of: Fix iteration bug over CPU reg properties")
Signed-off-by: Sergey Shtylyov 
Link: https://patch.msgid.link/0c7bf7e9-887c-42d5-bcfb-0ba7fe1e70b6@auroraos.dev
Signed-off-by: Rob Herring (Arm)

of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails

2026-06-04T19:41:22+00:00

The global pointer 'reserved_mem' continues to reference the
reserved_mem_array which lives in __initdata if
alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is
exported for post-init use, that would dereference freed memory
and trigger a use-after-free.

So reset reserved_mem_count to 0 when alloc_reserved_mem_array()
fails.

Fixes: 00c9a452a235 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array")
Signed-off-by: Wandun Chen 
Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm)

drivers/of: fdt: Make ibm,phandle logic only happen on pseries

2026-06-04T02:01:40+00:00

The "ibm,phandle" thing only seems to be needed on pseries
machines but everyone gets it so they get a string and a little
bit of useless code.

In __of_attach_node() the pseries specific part uses
IS_ENABLED(CONFIG_PPC_PSERIES) so do that here too.

Signed-off-by: Daniel Palmer 
Link: https://patch.msgid.link/20260603151809.3256280-1-daniel@thingy.jp
Signed-off-by: Rob Herring (Arm)