From: Rosen Penev <rosenp@gmail•com>
To: linux-pm@vger•kernel.org
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail•com>,
Krzysztof Kozlowski <krzk@kernel•org>,
"Rafael J. Wysocki" <rafael@kernel•org>,
Daniel Lezcano <daniel.lezcano@kernel•org>,
Zhang Rui <rui.zhang@intel•com>,
Lukasz Luba <lukasz.luba@arm•com>,
Peter Griffin <peter.griffin@linaro•org>,
Alim Akhtar <alim.akhtar@samsung•com>,
linux-samsung-soc@vger•kernel.org (open list:SAMSUNG THERMAL
DRIVER),
linux-arm-kernel@lists•infradead.org (moderated list:ARM/SAMSUNG
S3C, S5P AND EXYNOS ARM ARCHITECTURES),
linux-kernel@vger•kernel.org (open list)
Subject: [PATCHv2] thermal/drivers/exynos: fix clock ordering race and shared IRQ handling
Date: Wed, 3 Jun 2026 18:42:35 -0700 [thread overview]
Message-ID: <20260604014235.39303-1-rosenp@gmail.com> (raw)
Fix two pre-existing issues in exynos_tmu_probe/remove:
1. Clock ordering race: The driver manually unprepares clocks in
exynos_tmu_remove() and the probe error path, but the IRQ handler and
thermal zone are devm-managed and remain active until after the manual
cleanup. If the shared IRQ fires or the thermal zone is polled in that
window, clk_enable() is called on an unprepared clock, which is illegal.
Replace devm_clk_get() + manual clk_prepare() with devm_clk_get_prepared(),
and devm_clk_get() + manual clk_prepare_enable() with
devm_clk_get_enabled(), so clock unprepare is tied to the devm lifetime
and happens after the IRQ and thermal zone are released. Remove the
now-redundant manual cleanup from the error path and remove function.
2. Shared IRQ handling: The driver requests a shared IRQ (IRQF_SHARED) with
NULL as the hardirq handler, causing irq_default_primary_handler to wake
the threaded handler for every interrupt on the shared line and, combined
with IRQF_ONESHOT, mask the line until the thread completes. Replace the
NULL handler with a hardirq handler that reads the TMU interrupt status
register and returns IRQ_NONE when the TMU is not the interrupt source,
so other devices on the shared line are not delayed. Also return IRQ_NONE
from the threaded handler as a safety net if the interrupt was already
handled or cleared between the hardirq and threaded handler.
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail•com>
---
v2: fixed sashiko comments and moved TODO.
drivers/thermal/samsung/exynos_tmu.c | 104 ++++++++++++---------------
1 file changed, 46 insertions(+), 58 deletions(-)
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 47a99b3c5395..11b2f1e2670c 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -196,7 +196,7 @@ struct exynos_tmu_data {
void (*tmu_control)(struct platform_device *pdev, bool on);
int (*tmu_read)(struct exynos_tmu_data *data);
void (*tmu_set_emulation)(struct exynos_tmu_data *data, int temp);
- void (*tmu_clear_irqs)(struct exynos_tmu_data *data);
+ u32 (*tmu_clear_irqs)(struct exynos_tmu_data *data);
};
/*
@@ -756,28 +756,53 @@ static int exynos7_tmu_read(struct exynos_tmu_data *data)
EXYNOS7_TMU_TEMP_MASK;
}
-static irqreturn_t exynos_tmu_threaded_irq(int irq, void *id)
+static u32 exynos_tmu_intstat_offset(struct exynos_tmu_data *data)
+{
+ if (data->soc == SOC_ARCH_EXYNOS5260)
+ return EXYNOS5260_TMU_REG_INTSTAT;
+ if (data->soc == SOC_ARCH_EXYNOS7)
+ return EXYNOS7_TMU_REG_INTPEND;
+ if (data->soc == SOC_ARCH_EXYNOS5433)
+ return EXYNOS5433_TMU_REG_INTPEND;
+ return EXYNOS_TMU_REG_INTSTAT;
+}
+
+static irqreturn_t exynos_tmu_irq(int irq, void *id)
{
struct exynos_tmu_data *data = id;
- thermal_zone_device_update(data->tzd, THERMAL_EVENT_UNSPECIFIED);
+ if (!readl(data->base + exynos_tmu_intstat_offset(data)))
+ return IRQ_NONE;
+
+ return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t exynos_tmu_threaded_irq(int irq, void *id)
+{
+ struct exynos_tmu_data *data = id;
mutex_lock(&data->lock);
clk_enable(data->clk);
/* TODO: take action based on particular interrupt */
- data->tmu_clear_irqs(data);
+
+ if (!data->tmu_clear_irqs(data)) {
+ clk_disable(data->clk);
+ mutex_unlock(&data->lock);
+ return IRQ_NONE;
+ }
clk_disable(data->clk);
mutex_unlock(&data->lock);
+ thermal_zone_device_update(data->tzd, THERMAL_EVENT_UNSPECIFIED);
+
return IRQ_HANDLED;
}
-static void exynos4210_tmu_clear_irqs(struct exynos_tmu_data *data)
+static u32 exynos4210_tmu_clear_irqs(struct exynos_tmu_data *data)
{
- unsigned int val_irq;
- u32 tmu_intstat, tmu_intclear;
+ u32 val_irq, tmu_intstat, tmu_intclear;
if (data->soc == SOC_ARCH_EXYNOS5260) {
tmu_intstat = EXYNOS5260_TMU_REG_INTSTAT;
@@ -803,6 +828,8 @@ static void exynos4210_tmu_clear_irqs(struct exynos_tmu_data *data)
* support FALL IRQs at all).
*/
writel(val_irq, data->base + tmu_intclear);
+
+ return val_irq;
}
static const struct of_device_id exynos_tmu_match[] = {
@@ -1036,43 +1063,22 @@ static int exynos_tmu_probe(struct platform_device *pdev)
if (ret)
return ret;
- data->clk = devm_clk_get(dev, "tmu_apbif");
+ data->clk = devm_clk_get_prepared(dev, "tmu_apbif");
if (IS_ERR(data->clk))
return dev_err_probe(dev, PTR_ERR(data->clk), "Failed to get clock\n");
- data->clk_sec = devm_clk_get(dev, "tmu_triminfo_apbif");
- if (IS_ERR(data->clk_sec)) {
+ data->clk_sec = devm_clk_get_prepared(dev, "tmu_triminfo_apbif");
+ if (IS_ERR(data->clk_sec))
if (data->soc == SOC_ARCH_EXYNOS5420_TRIMINFO)
return dev_err_probe(dev, PTR_ERR(data->clk_sec),
"Failed to get triminfo clock\n");
- } else {
- ret = clk_prepare(data->clk_sec);
- if (ret) {
- dev_err(dev, "Failed to get clock\n");
- return ret;
- }
- }
-
- ret = clk_prepare(data->clk);
- if (ret) {
- dev_err(dev, "Failed to get clock\n");
- goto err_clk_sec;
- }
switch (data->soc) {
case SOC_ARCH_EXYNOS5433:
case SOC_ARCH_EXYNOS7:
- data->sclk = devm_clk_get(dev, "tmu_sclk");
- if (IS_ERR(data->sclk)) {
- ret = dev_err_probe(dev, PTR_ERR(data->sclk), "Failed to get sclk\n");
- goto err_clk;
- } else {
- ret = clk_prepare_enable(data->sclk);
- if (ret) {
- dev_err(dev, "Failed to enable sclk\n");
- goto err_clk;
- }
- }
+ data->sclk = devm_clk_get_enabled(dev, "tmu_sclk");
+ if (IS_ERR(data->sclk))
+ return dev_err_probe(dev, PTR_ERR(data->sclk), "Failed to get sclk\n");
break;
default:
break;
@@ -1081,55 +1087,37 @@ static int exynos_tmu_probe(struct platform_device *pdev)
ret = exynos_tmu_initialize(pdev);
if (ret) {
dev_err(dev, "Failed to initialize TMU\n");
- goto err_sclk;
+ return ret;
}
data->tzd = devm_thermal_of_zone_register(dev, 0, data,
&exynos_sensor_ops);
- if (IS_ERR(data->tzd)) {
- ret = dev_err_probe(dev, PTR_ERR(data->tzd), "Failed to register sensor\n");
- goto err_sclk;
- }
+ if (IS_ERR(data->tzd))
+ return dev_err_probe(dev, PTR_ERR(data->tzd), "Failed to register sensor\n");
ret = exynos_thermal_zone_configure(pdev);
if (ret) {
dev_err(dev, "Failed to configure the thermal zone\n");
- goto err_sclk;
+ return ret;
}
- ret = devm_request_threaded_irq(dev, data->irq, NULL,
+ ret = devm_request_threaded_irq(dev, data->irq, exynos_tmu_irq,
exynos_tmu_threaded_irq,
IRQF_TRIGGER_RISING
| IRQF_SHARED | IRQF_ONESHOT,
dev_name(dev), data);
if (ret) {
dev_err(dev, "Failed to request irq: %d\n", data->irq);
- goto err_sclk;
+ return ret;
}
exynos_tmu_control(pdev, true);
return 0;
-
-err_sclk:
- clk_disable_unprepare(data->sclk);
-err_clk:
- clk_unprepare(data->clk);
-err_clk_sec:
- if (!IS_ERR(data->clk_sec))
- clk_unprepare(data->clk_sec);
- return ret;
}
static void exynos_tmu_remove(struct platform_device *pdev)
{
- struct exynos_tmu_data *data = platform_get_drvdata(pdev);
-
exynos_tmu_control(pdev, false);
-
- clk_disable_unprepare(data->sclk);
- clk_unprepare(data->clk);
- if (!IS_ERR(data->clk_sec))
- clk_unprepare(data->clk_sec);
}
#ifdef CONFIG_PM_SLEEP
--
2.54.0
reply other threads:[~2026-06-04 1:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260604014235.39303-1-rosenp@gmail.com \
--to=rosenp@gmail$(echo .)com \
--cc=alim.akhtar@samsung$(echo .)com \
--cc=bzolnier@gmail$(echo .)com \
--cc=daniel.lezcano@kernel$(echo .)org \
--cc=krzk@kernel$(echo .)org \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-pm@vger$(echo .)kernel.org \
--cc=linux-samsung-soc@vger$(echo .)kernel.org \
--cc=lukasz.luba@arm$(echo .)com \
--cc=peter.griffin@linaro$(echo .)org \
--cc=rafael@kernel$(echo .)org \
--cc=rui.zhang@intel$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox