[PATCH 0/2] HID: intel-thc-hid: quiesce interrupts before final teardown

[PATCH 0/2] HID: intel-thc-hid: quiesce interrupts before final teardown

[Myeonghun Pak]

QuickSPI and QuickI2C can tear down HID/DMA resources while IRQ handlers
are still running. Stop new IRQ handling, wait for running handlers,
then drain recovery work and mask THC interrupts before final teardown.

This series covers remove, probe unwind and shutdown.

GCC 15.2.0 x86_64 W=1 builds, strict checkpatch and patch application
checks passed. No hardware runtime testing.

Base: 238650ef6c7c7cca08e032527329424c9fbd70e5

1. HID: intel-thc-hid: quickspi: quiesce IRQs during teardown
2. HID: intel-thc-hid: quicki2c: quiesce IRQs during teardown

Assisted-by: LLM

[PATCH 1/2] HID: intel-thc-hid: quickspi: quiesce IRQs during teardown

[Myeonghun Pak]

The managed IRQ can access HID/DMA buffers or queue recovery work while
remove or probe unwind tears down those resources.

Disable and synchronize the IRQ, drain recovery work, then mask THC
interrupts before freeing the IRQ and releasing HID/DMA resources.
Track IRQ/DMA initialization for conditional probe cleanup.

Disable the IRQ before shutdown deinit as well. Keep IRQ disabling and
release outside the shared hibernation helper.

This issue was found by static analysis.

Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (x86_64). No runtime testing.

Related recovery-work review and series:
https://lore-kernel.gnuweeb.org/linux-input/20260717035609.3874015-1-even.xu@intel.com/T/
https://patchew.org/linux/20260729050145.2272597-1-even.xu@intel.com/

 .../intel-quickspi/pci-quickspi.c             | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index 89226f5ce45e..0bd22f285c78 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -597,6 +597,8 @@ static int quickspi_probe(struct pci_dev *pdev,
 			  const struct pci_device_id *id)
 {
 	struct quickspi_device *qsdev;
+	bool dma_initialized = false;
+	bool irq_requested = false;
 	void __iomem *mem_addr;
 	int ret;
 
@@ -649,6 +651,7 @@ static int quickspi_probe(struct pci_dev *pdev,
 					qsdev);
 	if (ret)
 		goto dev_deinit;
+	irq_requested = true;
 
 	ret = reset_tic(qsdev);
 	if (ret) {
@@ -667,17 +670,18 @@ static int quickspi_probe(struct pci_dev *pdev,
 		dev_err(&pdev->dev, "Setup THC DMA failed, ret= %d\n", ret);
 		goto dev_deinit;
 	}
+	dma_initialized = true;
 
 	ret = quickspi_get_report_descriptor(qsdev);
 	if (ret) {
 		dev_err(&pdev->dev, "Get report descriptor failed, ret = %d\n", ret);
-		goto dma_deinit;
+		goto dev_deinit;
 	}
 
 	ret = quickspi_hid_probe(qsdev);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register HID device, ret = %d\n", ret);
-		goto dma_deinit;
+		goto dev_deinit;
 	}
 
 	qsdev->state = QUICKSPI_ENABLED;
@@ -692,10 +696,16 @@ static int quickspi_probe(struct pci_dev *pdev,
 
 	return 0;
 
-dma_deinit:
-	quickspi_dma_deinit(qsdev);
 dev_deinit:
+	if (irq_requested) {
+		WRITE_ONCE(qsdev->recovery_disabled, true);
+		disable_irq(pdev->irq);
+	}
 	quickspi_dev_deinit(qsdev);
+	if (irq_requested)
+		devm_free_irq(&pdev->dev, pdev->irq, qsdev);
+	if (dma_initialized)
+		quickspi_dma_deinit(qsdev);
 disable_pci_device:
 	pci_clear_master(pdev);
 
@@ -718,9 +728,12 @@ static void quickspi_remove(struct pci_dev *pdev)
 	if (!qsdev)
 		return;
 
-	quickspi_hid_remove(qsdev);
-
+	WRITE_ONCE(qsdev->recovery_disabled, true);
+	disable_irq(pdev->irq);
 	quickspi_dev_deinit(qsdev);
+	devm_free_irq(&pdev->dev, pdev->irq, qsdev);
+
+	quickspi_hid_remove(qsdev);
 
 	quickspi_dma_deinit(qsdev);
 
@@ -747,6 +760,9 @@ static void quickspi_shutdown(struct pci_dev *pdev)
 	if (!qsdev)
 		return;
 
+	WRITE_ONCE(qsdev->recovery_disabled, true);
+	disable_irq(pdev->irq);
+
 	quickspi_dev_deinit(qsdev);
 
 	/* Must stop DMA before reboot to avoid DMA entering into unknown state */

RE: [PATCH 1/2] HID: intel-thc-hid: quickspi: quiesce IRQs during teardown

[Xu, Even]

> -----Original Message-----
> From: Myeonghun Pak <mhun512@gmail.com>
> Sent: Monday, October 12, 2026 6:06 AM
> To: Xu, Even <even.xu@intel.com>; Sun, Xinpeng <xinpeng.sun@intel.com>; Jiri
> Kosina <jikos@kernel.org>; Benjamin Tissoires <bentiss@kernel.org>
> Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>; Mark Pearson
> <mpearson-lenovo@squebb.ca>; linux-input@vger.kernel.org; linux-
> kernel@vger.kernel.org; Ijae Kim <ae878000@gmail.com>
> Subject: [PATCH 1/2] HID: intel-thc-hid: quickspi: quiesce IRQs during teardown
> 
> The managed IRQ can access HID/DMA buffers or queue recovery work while
> remove or probe unwind tears down those resources.
> 
> Disable and synchronize the IRQ, drain recovery work, then mask THC interrupts
> before freeing the IRQ and releasing HID/DMA resources.
> Track IRQ/DMA initialization for conditional probe cleanup.
> 
> Disable the IRQ before shutdown deinit as well. Keep IRQ disabling and release
> outside the shared hibernation helper.
> 
> This issue was found by static analysis.

Thanks for your patch!

I think this patch is still necessary. It can prevent some extremely unlikely but problematic cases, such as an interrupt already being queued in the thread before the THC interrupt is disabled. Have you tested this code on actual hardware?

Best Regards,
Even Xu

> 
> Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI
> driver")
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
> Compile-tested with GCC, W=1 (x86_64). No runtime testing.
> 
> Related recovery-work review and series:
> https://lore-kernel.gnuweeb.org/linux-input/20260717035609.3874015-1-
> even.xu@intel.com/T/
> https://patchew.org/linux/20260729050145.2272597-1-even.xu@intel.com/
> 
>  .../intel-quickspi/pci-quickspi.c             | 28 +++++++++++++++----
>  1 file changed, 22 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> index 89226f5ce45e..0bd22f285c78 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> @@ -597,6 +597,8 @@ static int quickspi_probe(struct pci_dev *pdev,
>  			  const struct pci_device_id *id)
>  {
>  	struct quickspi_device *qsdev;
> +	bool dma_initialized = false;
> +	bool irq_requested = false;
>  	void __iomem *mem_addr;
>  	int ret;
> 
> @@ -649,6 +651,7 @@ static int quickspi_probe(struct pci_dev *pdev,
>  					qsdev);
>  	if (ret)
>  		goto dev_deinit;
> +	irq_requested = true;
> 
>  	ret = reset_tic(qsdev);
>  	if (ret) {
> @@ -667,17 +670,18 @@ static int quickspi_probe(struct pci_dev *pdev,
>  		dev_err(&pdev->dev, "Setup THC DMA failed, ret= %d\n", ret);
>  		goto dev_deinit;
>  	}
> +	dma_initialized = true;
> 
>  	ret = quickspi_get_report_descriptor(qsdev);
>  	if (ret) {
>  		dev_err(&pdev->dev, "Get report descriptor failed, ret = %d\n",
> ret);
> -		goto dma_deinit;
> +		goto dev_deinit;
>  	}
> 
>  	ret = quickspi_hid_probe(qsdev);
>  	if (ret) {
>  		dev_err(&pdev->dev, "Failed to register HID device, ret = %d\n",
> ret);
> -		goto dma_deinit;
> +		goto dev_deinit;
>  	}
> 
>  	qsdev->state = QUICKSPI_ENABLED;
> @@ -692,10 +696,16 @@ static int quickspi_probe(struct pci_dev *pdev,
> 
>  	return 0;
> 
> -dma_deinit:
> -	quickspi_dma_deinit(qsdev);
>  dev_deinit:
> +	if (irq_requested) {
> +		WRITE_ONCE(qsdev->recovery_disabled, true);
> +		disable_irq(pdev->irq);
> +	}
>  	quickspi_dev_deinit(qsdev);
> +	if (irq_requested)
> +		devm_free_irq(&pdev->dev, pdev->irq, qsdev);
> +	if (dma_initialized)
> +		quickspi_dma_deinit(qsdev);
>  disable_pci_device:
>  	pci_clear_master(pdev);
> 
> @@ -718,9 +728,12 @@ static void quickspi_remove(struct pci_dev *pdev)
>  	if (!qsdev)
>  		return;
> 
> -	quickspi_hid_remove(qsdev);
> -
> +	WRITE_ONCE(qsdev->recovery_disabled, true);
> +	disable_irq(pdev->irq);
>  	quickspi_dev_deinit(qsdev);
> +	devm_free_irq(&pdev->dev, pdev->irq, qsdev);
> +
> +	quickspi_hid_remove(qsdev);
> 
>  	quickspi_dma_deinit(qsdev);
> 
> @@ -747,6 +760,9 @@ static void quickspi_shutdown(struct pci_dev *pdev)
>  	if (!qsdev)
>  		return;
> 
> +	WRITE_ONCE(qsdev->recovery_disabled, true);
> +	disable_irq(pdev->irq);
> +
>  	quickspi_dev_deinit(qsdev);
> 
>  	/* Must stop DMA before reboot to avoid DMA entering into unknown
> state */

[PATCH 2/2] HID: intel-thc-hid: quicki2c: quiesce IRQs during teardown

[Myeonghun Pak]

The managed IRQ can access HID/DMA buffers or queue recovery work while
remove or probe unwind tears down those resources.

Disable and synchronize the IRQ, drain recovery work, then mask THC
interrupts before freeing the IRQ and releasing HID/DMA resources.
Track IRQ/DMA initialization for conditional probe cleanup.

Disable the IRQ before shutdown deinit as well. Keep IRQ disabling and
release outside the shared hibernation helper.

This issue was found by static analysis.

Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (x86_64). No runtime testing.

Related recovery-work review and series:
https://lore-kernel.gnuweeb.org/linux-input/20260717035609.3874015-1-even.xu@intel.com/T/
https://patchew.org/linux/20260729050145.2272597-1-even.xu@intel.com/

 .../intel-quicki2c/pci-quicki2c.c             | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
index 0d2ad7bc3648..9a9b640f32b3 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -648,6 +648,8 @@ static int quicki2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	const struct quicki2c_ddata *ddata = (const struct quicki2c_ddata *)id->driver_data;
 	struct quicki2c_device *qcdev;
+	bool dma_initialized = false;
+	bool irq_requested = false;
 	void __iomem *mem_addr;
 	int ret;
 
@@ -700,6 +702,7 @@ static int quicki2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 					qcdev);
 	if (ret)
 		goto dev_deinit;
+	irq_requested = true;
 
 	ret = quicki2c_get_device_descriptor(qcdev);
 	if (ret) {
@@ -718,6 +721,7 @@ static int quicki2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		dev_err(&pdev->dev, "Setup THC DMA failed, ret= %d\n", ret);
 		goto dev_deinit;
 	}
+	dma_initialized = true;
 
 	ret = thc_interrupt_quiesce(qcdev->thc_hw, false);
 	if (ret)
@@ -738,13 +742,13 @@ static int quicki2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	ret = quicki2c_get_report_descriptor(qcdev);
 	if (ret) {
 		dev_err(&pdev->dev, "Get report descriptor failed, ret = %d\n", ret);
-		goto dma_deinit;
+		goto dev_deinit;
 	}
 
 	ret = quicki2c_hid_probe(qcdev);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register HID device, ret = %d\n", ret);
-		goto dma_deinit;
+		goto dev_deinit;
 	}
 
 	qcdev->state = QUICKI2C_ENABLED;
@@ -759,10 +763,16 @@ static int quicki2c_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	return 0;
 
-dma_deinit:
-	quicki2c_dma_deinit(qcdev);
 dev_deinit:
+	if (irq_requested) {
+		WRITE_ONCE(qcdev->recovery_disabled, true);
+		disable_irq(pdev->irq);
+	}
 	quicki2c_dev_deinit(qcdev);
+	if (irq_requested)
+		devm_free_irq(&pdev->dev, pdev->irq, qcdev);
+	if (dma_initialized)
+		quicki2c_dma_deinit(qcdev);
 disable_pci_device:
 	pci_clear_master(pdev);
 
@@ -784,9 +794,12 @@ static void quicki2c_remove(struct pci_dev *pdev)
 	if (!qcdev)
 		return;
 
-	quicki2c_hid_remove(qcdev);
-
+	WRITE_ONCE(qcdev->recovery_disabled, true);
+	disable_irq(pdev->irq);
 	quicki2c_dev_deinit(qcdev);
+	devm_free_irq(&pdev->dev, pdev->irq, qcdev);
+
+	quicki2c_hid_remove(qcdev);
 
 	quicki2c_dma_deinit(qcdev);
 
@@ -811,6 +824,9 @@ static void quicki2c_shutdown(struct pci_dev *pdev)
 	if (!qcdev)
 		return;
 
+	WRITE_ONCE(qcdev->recovery_disabled, true);
+	disable_irq(pdev->irq);
+
 	quicki2c_dev_deinit(qcdev);
 
 	/* Must stop DMA before reboot to avoid DMA entering into unknown state */