[PATCH v3 0/2] thermal: imx: Add calibration offset support

[PATCH v3 0/2] thermal: imx: Add calibration offset support

[HaoNing Cheng via B4 Relay]

Some i.MX boards need a small per-design correction to align the
reported CPU temperature with board-level measurements. This series
adds an optional DT property to specify such a calibration offset
and implements the corresponding support in the imx_thermal driver.

Patch 1 documents the new fsl,temp-calibration-offset-millicelsius
property in the i.MX thermal DT binding.

Patch 2 reads this property in the imx_thermal driver and applies
the offset to the i.MX6/6SX/7D calibration formulas. When the
property is absent, the default offset remains 0, preserving the
current behaviour.

Signed-off-by: Haoning CHENG <Haoning.CHENG@cn.bosch.com>
---
Changes in v3:
- dt-bindings: add minimum/maximum (-28580/+28580) for
  temp-calibration-offset-millicelsius, as suggested by Conor Dooley
- Link to v2: https://patch.msgid.link/20260709-b4-symana21-11221-imx-thermal-support-upstream-6-18-v2-0-00ff72495e24@cn.bosch.com

Changes in v2:
- dt-bindings: Removed explicit `$ref: /schemas/types.yaml#/definitions/int32`
  for fsl,temp-calibration-offset-millicelsius; the `-millicelsius` suffix
  already resolves to int32-array via property-units.yaml (Rob).
- dt-bindings: Fixed example indentation.
- driver: Replaced C integer division (/) with DIV_ROUND_CLOSEST() in
  imx_set_alarm_temp() to prevent off-by-one alarm threshold mismatch that
  could cause IRQ storms on i.MX7D.
- driver: Added clamp() bounds check for alarm_value [0, 0x1ff] to avoid
  corrupting adjacent register fields (PANIC_ALARM).
- Link to v1: https://patch.msgid.link/20260709-b4-symana21-11221-imx-thermal-support-upstream-6-18-v1-0-00f88f42930b@cn.bosch.com

To: "Rafael J. Wysocki" <rafael@kernel.org>
To: Daniel Lezcano <daniel.lezcano@linaro.org>
To: Zhang Rui <rui.zhang@intel.com>
To: Lukasz Luba <lukasz.luba@arm.com>
To: Rob Herring <robh@kernel.org>
To: Krzysztof Kozlowski <krzk+dt@kernel.org>
To: Conor Dooley <conor+dt@kernel.org>
To: Shawn Guo <shawnguo@kernel.org>
To: Sascha Hauer <s.hauer@pengutronix.de>
To: Pengutronix Kernel Team <kernel@pengutronix.de>
To: Fabio Estevam <festevam@gmail.com>
Cc: linux-pm@vger.kernel.org
Cc: devicetree@vger.kernel.org
Cc: imx@lists.linux.dev
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org

---
HaoNing Cheng (2):
      dt-bindings: thermal: imx: Document calibration offset property
      thermal/drivers/imx: Add calibration offset support

 .../devicetree/bindings/thermal/imx-thermal.yaml       | 10 ++++++++++
 drivers/thermal/imx_thermal.c                          | 18 +++++++++++++-----
 2 files changed, 23 insertions(+), 5 deletions(-)
---
base-commit: c50a940dcde35c647e097e89a9150003abd48329
change-id: 20260709-b4-symana21-11221-imx-thermal-support-upstream-6-18-a084984deb76

Best regards,
--  
Haoning CHENG <Haoning.CHENG@cn.bosch.com>

[PATCH v3 1/2] dt-bindings: thermal: imx: Document calibration offset property

[HaoNing Cheng via B4 Relay]

From: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>

Some boards need a small per-design correction to align the reported CPU
temperature with board-level measurements.

Document the optional fsl,temp-calibration-offset-millicelsius property,
a signed offset in millicelsius that is added to the calculated sensor
temperature. The property is optional and the existing behaviour is kept
when it is omitted.

Update the binding example to show its usage.

Signed-off-by: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>
---
 Documentation/devicetree/bindings/thermal/imx-thermal.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
index 949b154856c5..704bf2fa48cf 100644
--- a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
+++ b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
@@ -59,6 +59,15 @@ properties:
   clocks:
     maxItems: 1
 
+  fsl,temp-calibration-offset-millicelsius:
+    maxItems: 1
+    description:
+      A signed calibration offset, in millicelsius, added to the calculated
+      sensor temperature to compensate for board-level measurement
+      differences. When absent, no offset is applied.
+    minimum: -28580
+    maximum: 28580
+
   "#thermal-sensor-cells":
     const: 0
 
@@ -109,6 +118,7 @@ examples:
             nvmem-cells = <&tempmon_calib>, <&tempmon_temp_grade>;
             nvmem-cell-names = "calib", "temp_grade";
             clocks = <&clks IMX6SX_CLK_PLL3_USB_OTG>;
+            fsl,temp-calibration-offset-millicelsius = <(-6400)>;
             #thermal-sensor-cells = <0>;
         };
     };

-- 
2.43.0

[PATCH v3 2/2] thermal/drivers/imx: Add calibration offset support

[HaoNing Cheng via B4 Relay]

From: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>

Some boards need a small per-design correction to align the reported CPU
temperature with board-level measurements.

Read the optional fsl,temp-calibration-offset-millicelsius property from
DT and apply it to the i.MX6/6SX/7D calibration formulas. When the
property is not present, the default offset remains 0, preserving the
current behaviour.

Signed-off-by: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>
---
 drivers/thermal/imx_thermal.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 38c993d1bcb3..8062d34ffed8 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -207,6 +207,7 @@ struct imx_thermal_data {
 	struct regmap *tempmon;
 	u32 c1, c2; /* See formula in imx_init_calib() */
 	int temp_max;
+	s32 calibration_offset;
 	int alarm_temp;
 	int last_temp;
 	bool irq_enabled;
@@ -240,10 +241,13 @@ static void imx_set_alarm_temp(struct imx_thermal_data *data,
 
 	data->alarm_temp = alarm_temp;
 
-	if (data->socdata->version == TEMPMON_IMX7D)
-		alarm_value = alarm_temp / 1000 + data->c1 - 25;
-	else
+	if (data->socdata->version == TEMPMON_IMX7D) {
+		alarm_value = DIV_ROUND_UP(alarm_temp - data->calibration_offset,
+					   1000) + data->c1 - 25;
+		alarm_value = clamp(alarm_value, 0, 0x1ff);
+	} else {
 		alarm_value = (data->c2 - alarm_temp) / data->c1;
+	}
 
 	regmap_write(map, soc_data->high_alarm_ctrl + REG_CLR,
 		     soc_data->high_alarm_mask);
@@ -274,7 +278,7 @@ static int imx_get_temp(struct thermal_zone_device *tz, int *temp)
 
 	/* See imx_init_calib() for formula derivation */
 	if (data->socdata->version == TEMPMON_IMX7D)
-		*temp = (n_meas - data->c1 + 25) * 1000;
+		*temp = (n_meas - data->c1 + 25) * 1000 + data->calibration_offset;
 	else
 		*temp = data->c2 - n_meas * data->c1;
 
@@ -413,7 +417,7 @@ static int imx_init_calib(struct platform_device *pdev, u32 ocotp_ana1)
 	temp64 *= 1000; /* to get result in °mC */
 	do_div(temp64, 15423 * n1 - 4148468);
 	data->c1 = temp64;
-	data->c2 = n1 * data->c1 + 28581;
+	data->c2 = n1 * data->c1 + 28581 + data->calibration_offset;
 
 	return 0;
 }
@@ -629,6 +633,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, data);
 
+	of_property_read_s32(dev->of_node,
+			     "fsl,temp-calibration-offset-millicelsius",
+			     &data->calibration_offset);
+
 	if (of_property_present(dev->of_node, "nvmem-cells")) {
 		ret = imx_init_from_nvmem_cells(pdev);
 		if (ret)

-- 
2.43.0

Re: [PATCH v3 1/2] dt-bindings: thermal: imx: Document calibration offset property

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly documented `fsl,temp-calibration-offset-millicelsius` device tree property is not implemented in the corresponding thermal driver.
--

--- Patch [1]: [PATCH v3 1/2] dt-bindings: thermal: imx: Document calibration offset property ---
commit fabff9a1c8bc1005fe350da46dd065d5e508aee0
Author: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>

dt-bindings: thermal: imx: Document calibration offset property

Some boards need a small per-design correction to align the reported CPU
temperature with board-level measurements. Document the optional
fsl,temp-calibration-offset-millicelsius property, a signed offset in
millicelsius that is added to the calculated sensor temperature. Update the
binding example to show its usage.

> diff --git a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> index 949b154856c53..704bf2fa48cf5 100644
> --- a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> +++ b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> @@ -59,6 +59,15 @@ properties:
>    clocks:
>      maxItems: 1
>  
> +  fsl,temp-calibration-offset-millicelsius:
> +    maxItems: 1
> +    description:
> +      A signed calibration offset, in millicelsius, added to the calculated

[Severity: Medium]
Is this property actually implemented in the corresponding thermal driver?

Without parsing and applying this offset in the C code, the device tree
property will be silently ignored when provided by the boot environment.
This could result in incorrect temperature readings for boards relying on
this calibration, potentially leading to premature or delayed thermal
throttling.

> +      sensor temperature to compensate for board-level measurement
> +      differences. When absent, no offset is applied.
> +    minimum: -28580
> +    maximum: 28580
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710-b4-symana21-11221-imx-thermal-support-upstream-6-18-v3-0-db9fc2947c55@cn.bosch.com?part=1

Re: [PATCH v3 2/2] thermal/drivers/imx: Add calibration offset support

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

New issues:
- [Medium] The patch introduces `fsl,temp-calibration-offset-millicelsius` without bounding its value. For non-IMX7D platforms, an accidentally or maliciously large calibration offset will cause `alarm_value` (and `critical_value`) to exceed their bitmask, corrupting adjacent register fields during the unbounded shift and `REG_SET` operation.

Pre-existing issues:
- [High] If `pm_runtime_resume_and_get()` fails in probe, the error path leaks the thermal zone device and triggers a double-put of the runtime PM usage count. Additionally, `imx_thermal_remove` has an unconditional PM usage count underflow.
- [High] Early error returns in `imx_get_temp` fail to drop the PM runtime reference, causing a resource leak.
- [High] A data race on the boolean flag `data->irq_enabled` between `imx_change_mode` and the hardirq handler can cause the thermal alarm IRQ to become permanently disabled.
- [High] The thermal alarm IRQ thread can execute after the thermal zone has been unregistered and freed during driver removal.
--

--- Patch [2]: [PATCH v3 2/2] thermal/drivers/imx: Add calibration offset support ---
commit 311020e0627d8a262b45753877ad91b58881323e
Author: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>

thermal/drivers/imx: Add calibration offset support

This patch introduces a device tree property to apply a small calibration 
offset to the reported CPU temperature. It reads the property and applies it 
to the i.MX6/6SX/7D calibration formulas while preserving the default behavior.

> diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
> --- a/drivers/thermal/imx_thermal.c
> +++ b/drivers/thermal/imx_thermal.c
> @@ -240,10 +241,13 @@ static void imx_set_alarm_temp(struct imx_thermal_data *data,
>  
>  	data->alarm_temp = alarm_temp;
>  
> -	if (data->socdata->version == TEMPMON_IMX7D)
> -		alarm_value = alarm_temp / 1000 + data->c1 - 25;
> -	else
> +	if (data->socdata->version == TEMPMON_IMX7D) {
> +		alarm_value = DIV_ROUND_UP(alarm_temp - data->calibration_offset,
> +					   1000) + data->c1 - 25;
> +		alarm_value = clamp(alarm_value, 0, 0x1ff);
> +	} else {
>  		alarm_value = (data->c2 - alarm_temp) / data->c1;
> +	}
>  
>  	regmap_write(map, soc_data->high_alarm_ctrl + REG_CLR,
>  		     soc_data->high_alarm_mask);

[Severity: Medium]
For non-IMX7D platforms, does this code allow an unbounded calibration offset
from the device tree to overflow the alarm_value?

If a large offset is provided, data->c2 will be skewed. This could cause
alarm_value to exceed its bitmask since it is not clamped in the else branch.
Could this corrupt adjacent register fields during the shifted REG_SET
operation below?

> @@ -274,7 +278,7 @@ static int imx_get_temp(struct thermal_zone_device *tz, int *temp)
>  
>  	/* See imx_init_calib() for formula derivation */
>  	if (data->socdata->version == TEMPMON_IMX7D)
> -		*temp = (n_meas - data->c1 + 25) * 1000;
> +		*temp = (n_meas - data->c1 + 25) * 1000 + data->calibration_offset;
>  	else
>  		*temp = data->c2 - n_meas * data->c1;

[Severity: High]
This is a pre-existing issue, but looking earlier in imx_get_temp(), if the
sensor is busy, the function returns early without dropping the PM runtime
reference:

drivers/thermal/imx_thermal.c:imx_get_temp() {
    ret = pm_runtime_resume_and_get(data->dev);
    if (ret < 0)
        return ret;

    regmap_read(map, soc_data->temp_data, &val);

    if ((val & soc_data->temp_valid_mask) == 0)
        return -EAGAIN;
    ...
}

Does this cause a permanent resource leak of the device PM runtime usage
counter when -EAGAIN is returned?

> @@ -629,6 +633,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, data);
>  
> +	of_property_read_s32(dev->of_node,
> +			     "fsl,temp-calibration-offset-millicelsius",
> +			     &data->calibration_offset);
> +
>  	if (of_property_present(dev->of_node, "nvmem-cells")) {
>  		ret = imx_init_from_nvmem_cells(pdev);

[Severity: High]
This is a pre-existing issue, but further down in imx_thermal_probe(), if
pm_runtime_resume_and_get() fails, the error path jumps to disable_runtime_pm:

drivers/thermal/imx_thermal.c:imx_thermal_probe() {
    ...
    ret = pm_runtime_resume_and_get(data->dev);
    if (ret < 0)
        goto disable_runtime_pm;
    ...
thermal_zone_unregister:
    thermal_zone_device_unregister(data->tz);
disable_runtime_pm:
    pm_runtime_put_noidle(data->dev);
    pm_runtime_disable(data->dev);
    ...
}

Since the jump bypasses thermal_zone_device_unregister(), and data is devres
managed, does this leave an orphaned thermal zone registered that will cause a
use-after-free when polled? Additionally, since the usage count is already 0
on resume failure, does the pm_runtime_put_noidle() cause an underflow?

[Severity: High]
This is a pre-existing issue, but there appears to be a use-after-free during
driver removal.

In imx_thermal_remove(), thermal_zone_device_unregister(data->tz) is explicitly
called, but the IRQ thread is devres-managed and continues to be active until
after the remove function returns:

drivers/thermal/imx_thermal.c:imx_thermal_alarm_irq_thread() {
    ...
    thermal_zone_device_update(data->tz, THERMAL_EVENT_UNSPECIFIED);
    ...
}

Can the devm-managed IRQ fire during module teardown and access the freed
data->tz pointer here?

[Severity: High]
This is a pre-existing issue, but there seems to be a data race on the
data->irq_enabled flag that can permanently disable the thermal alarm IRQ.

If the thermal zone mode is changed via sysfs concurrently with a hardware
thermal alarm interrupt, both paths check and modify the flag locklessly:

drivers/thermal/imx_thermal.c:imx_change_mode() {
    if (data->irq_enabled) {
        disable_irq(data->irq);
        data->irq_enabled = false;
    }
    ...
}

drivers/thermal/imx_thermal.c:imx_thermal_alarm_irq() {
    ...
    disable_irq_nosync(irq);
    data->irq_enabled = false;
    ...
}

Could both paths execute their disable function, incrementing the IRQ depth
twice, such that subsequent enables leave the IRQ physically disabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710-b4-symana21-11221-imx-thermal-support-upstream-6-18-v3-0-db9fc2947c55@cn.bosch.com?part=2

Re: [PATCH v3 1/2] dt-bindings: thermal: imx: Document calibration offset property

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 2015 bytes --]

On Fri, Jul 10, 2026 at 10:50:40AM +0800, HaoNing Cheng via B4 Relay wrote:
> From: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>
> 
> Some boards need a small per-design correction to align the reported CPU
> temperature with board-level measurements.
> 
> Document the optional fsl,temp-calibration-offset-millicelsius property,
> a signed offset in millicelsius that is added to the calculated sensor
> temperature. The property is optional and the existing behaviour is kept
> when it is omitted.
> 
> Update the binding example to show its usage.
> 
> Signed-off-by: HaoNing Cheng <Haoning.CHENG@cn.bosch.com>

Acked-by: Conor Dooley <conor.dooley@microchip.com>
pw-bot: not-applicable

> ---
>  Documentation/devicetree/bindings/thermal/imx-thermal.yaml | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> index 949b154856c5..704bf2fa48cf 100644
> --- a/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> +++ b/Documentation/devicetree/bindings/thermal/imx-thermal.yaml
> @@ -59,6 +59,15 @@ properties:
>    clocks:
>      maxItems: 1
>  
> +  fsl,temp-calibration-offset-millicelsius:
> +    maxItems: 1
> +    description:
> +      A signed calibration offset, in millicelsius, added to the calculated
> +      sensor temperature to compensate for board-level measurement
> +      differences. When absent, no offset is applied.
> +    minimum: -28580
> +    maximum: 28580
> +
>    "#thermal-sensor-cells":
>      const: 0
>  
> @@ -109,6 +118,7 @@ examples:
>              nvmem-cells = <&tempmon_calib>, <&tempmon_temp_grade>;
>              nvmem-cell-names = "calib", "temp_grade";
>              clocks = <&clks IMX6SX_CLK_PLL3_USB_OTG>;
> +            fsl,temp-calibration-offset-millicelsius = <(-6400)>;
>              #thermal-sensor-cells = <0>;
>          };
>      };
> 
> -- 
> 2.43.0
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]