rtc: Add support for limited alarm timer offsets

Some alarm timers are based on time offsets, not on absolute times. In some situations, the amount of time that can be scheduled in the future is limited. This may result in a refusal to suspend the system, causing substantial battery drain.

Some RTC alarm drivers remedy the situation by setting the alarm time to the maximum supported time if a request for an out-of-range timeout is made. This is not really desirable since it may result in unexpected early wakeups.

To reduce the impact of this problem, let RTC drivers report the maximum supported alarm timer offset. The code setting alarm timers can then decide if it wants to reject setting alarm timers to a larger value, if it wants to implement recurring alarms until the actually requested alarm time is met, or if it wants to accept the limited alarm time.

Only introduce the necessary variable into struct rtc_device. Code to set and use the variable will follow with subsequent patches.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

 include/linux/rtc.h | 1 +
 1 file changed, 1 insertion(+)

include/linux/rtc.h +1 -0

index 1fd9c6a21ebe..4c0bcbeb1f00 100644
@@ -146,6 +146,7 @@ struct rtc_device {
 
 	time64_t range_min;
 	timeu64_t range_max;
+	timeu64_t alarm_offset_max;
 	time64_t start_secs;
 	time64_t offset_secs;
 	bool set_start_time;

Hi Alexandre,

Quoted 16 lines · Guenter Roeck

Some alarm timers are based on time offsets, not on absolute times. In some situations, the amount of time that can be scheduled in the future is limited. This may result in a refusal to suspend the system, causing substantial battery drain.

Some RTC alarm drivers remedy the situation by setting the alarm time to the maximum supported time if a request for an out-of-range timeout is made. This is not really desirable since it may result in unexpected early wakeups.

To reduce the impact of this problem, let RTC drivers report the maximum supported alarm timer offset. The code setting alarm timers can then decide if it wants to reject setting alarm timers to a larger value, if it wants to implement recurring alarms until the actually requested alarm time is met, or if it wants to accept the limited alarm time.

Quoted 5 lines

Only introduce the necessary variable into struct rtc_device. Code to set and use the variable will follow with subsequent patches.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

I guess it is a bit late to get the series into v6.6, but would it be possible to apply it to a -next branch to get some more test coverage ?

Either case, do you have any additional comments / feedback ?

Thanks,
Guenter

Quoted 18 lines

---
v2: Rename range_max_offset -> alarm_offset_max

 include/linux/rtc.h | 1 +
 1 file changed, 1 insertion(+)

include/linux/rtc.h +1 -0

index 1fd9c6a21ebe..4c0bcbeb1f00 100644
@@ -146,6 +146,7 @@ struct rtc_device {
 
 	time64_t range_min;
 	timeu64_t range_max;
+	timeu64_t alarm_offset_max;
 	time64_t start_secs;
 	time64_t offset_secs;
 	bool set_start_time;

Hello,

Quoted 25 lines · Guenter Roeck

Hi Alexandre,

Quoted 21 lines · Guenter Roeck

Some alarm timers are based on time offsets, not on absolute times. In some situations, the amount of time that can be scheduled in the future is limited. This may result in a refusal to suspend the system, causing substantial battery drain.

Some RTC alarm drivers remedy the situation by setting the alarm time to the maximum supported time if a request for an out-of-range timeout is made. This is not really desirable since it may result in unexpected early wakeups.

To reduce the impact of this problem, let RTC drivers report the maximum supported alarm timer offset. The code setting alarm timers can then decide if it wants to reject setting alarm timers to a larger value, if it wants to implement recurring alarms until the actually requested alarm time is met, or if it wants to accept the limited alarm time.

Only introduce the necessary variable into struct rtc_device. Code to set and use the variable will follow with subsequent patches.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Quoted 3 lines

I guess it is a bit late to get the series into v6.6, but would it be possible to apply it to a -next branch to get some more test coverage ?

I'm probably going to take 1 and 3-7 for 6.6 once I get a reliable internet access. I can't take 2/7 without a review or ack from the time maintainers.

Quoted 2 lines

Either case, do you have any additional comments / feedback ?

The main issue that remains is that after 2/7, the rtc_device structure is not opaque anymore to its user as alarmtimer_suspend now directly accesses one of the members. But I'd have to find which RTCs have an absolute limit so we can design a proper API. I may also decide that it is good enough to require that the alarm range must cover the registered RTC range.

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

 kernel/time/alarmtimer.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

kernel/time/alarmtimer.c +2 -0

index 8d9f13d847f0..895e3a6d6444 100644
@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
        rtc_timer_cancel(rtc, &rtctimer);
        rtc_read_time(rtc, &tm);
        now = rtc_tm_to_ktime(tm);
+
+       /*

Quoted 39 lines · Guenter Roeck

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

 kernel/time/alarmtimer.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

kernel/time/alarmtimer.c +2 -0

index 8d9f13d847f0..895e3a6d6444 100644
@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
        rtc_timer_cancel(rtc, &rtctimer);
        rtc_read_time(rtc, &tm);
        now = rtc_tm_to_ktime(tm);
+
+       /*

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 304

Quoted 10 lines

kernel/time/alarmtimer.c +10 -0

+        * If the RTC alarm timer only supports a limited time offset, set
+        * the alarm time to the maximum supported value.
+        * The system will wake up earlier than necessary and is expected
+        * to go back to sleep if it has nothing to do.
+        * It would be desirable to handle such early wakeups without fully
+        * waking up the system, but it is unknown if this is even possible.
+        */
+       if (rtc->alarm_offset_max &&
+           rtc->alarm_offset_max * MSEC_PER_SEC < ktime_to_ms(min))
+               min = ms_to_ktime(rtc->alarm_offset_max * MSEC_PER_SEC);

I don't really have an objection here, but I wonder if this would be better abstracted by a rtc_ function?

ktime_t rtc_bound_ktime_interval(ktime interval)

{
if (!rtc->alarm_offset_max)

      return interval;

return ms_to_ktime(min(rtc->alarm_offset_max, ktime_to_ms(interval)));

}

(simple enough to throw into rtc.h maybe as an inline function?)

Then the above would be tweaked to:
min = rtc_bound_interval(min);

thanks
-john

Quoted 29 lines · Guenter Roeck

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

 kernel/time/alarmtimer.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

Quoted 5 lines

kernel/time/alarmtimer.c +0 -0

index 8d9f13d847f0..895e3a6d6444 100644

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 298

Quoted 9 lines

kernel/time/alarmtimer.c +6 -0

@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
        rtc_timer_cancel(rtc, &rtctimer);
        rtc_read_time(rtc, &tm);
        now = rtc_tm_to_ktime(tm);
+
+       /*
+        * If the RTC alarm timer only supports a limited time offset, set
+        * the alarm time to the maximum supported value.
+        * The system will wake up earlier than necessary and is expected
+        * to go back to sleep if it has nothing to do.

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 304

Quoted 6 lines

kernel/time/alarmtimer.c +6 -0

+        * It would be desirable to handle such early wakeups without fully
+        * waking up the system, but it is unknown if this is even possible.
+        */
+       if (rtc->alarm_offset_max &&
+           rtc->alarm_offset_max * MSEC_PER_SEC < ktime_to_ms(min))
+               min = ms_to_ktime(rtc->alarm_offset_max * MSEC_PER_SEC);

I don't really have an objection here, but I wonder if this would be better abstracted by a rtc_ function?

ktime_t rtc_bound_ktime_interval(ktime interval)
{
if (!rtc->alarm_offset_max)

      return interval;

return ms_to_ktime(min(rtc->alarm_offset_max, ktime_to_ms(interval)));
}

(simple enough to throw into rtc.h maybe as an inline function?)

Then the above would be tweaked to:
min = rtc_bound_interval(min);

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

 kernel/time/alarmtimer.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

kernel/time/alarmtimer.c +0 -0

index 8d9f13d847f0..895e3a6d6444 100644

Quoting Guenter Roeck (2023-08-17 15:55:32)

Quoted 37 lines

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

  kernel/time/alarmtimer.c | 13 +++++++++++++

kernel/time/alarmtimer.c +2 -0

index 8d9f13d847f0..895e3a6d6444 100644
@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
         rtc_timer_cancel(rtc, &rtctimer);
         rtc_read_time(rtc, &tm);
         now = rtc_tm_to_ktime(tm);
+
+       /*

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 298

Quoted 4 lines

kernel/time/alarmtimer.c +4 -0

+        * If the RTC alarm timer only supports a limited time offset, set
+        * the alarm time to the maximum supported value.
+        * The system will wake up earlier than necessary and is expected
+        * to go back to sleep if it has nothing to do.

Does this assume that the kernel is configured for autosuspend (CONFIG_PM_AUTOSLEEP)? Maybe we should only do this when that config is enabled.

If userspace is the one autosuspending, then I don't know what we do, or how the kernel knows it is OK. Maybe we need another alarmtimer clock id that will fail creation if the wakeup time is larger than what the rtc can be programmed for? Or maybe that new clock id can have this fixed behavior to wakeup early with the assumption that userspace will go back to sleep, and outdated userspace can use the original alarmtimer clock id if they don't care about suspend failing?

I see another problem too. What do we do if an alarmtimer is created, the rtc device is unregistered, and then we enter suspend? It looks like alarmtimer_suspend() bails out early with no error, so suspend continues. That looks wrong. Presumably we should fail suspend entirely at that point because we'll never be able to wakeup to run the alarmtimer.

Quoted 38 lines

Quoting Guenter Roeck (2023-08-17 15:55:32)

Quoted 37 lines

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

  kernel/time/alarmtimer.c | 13 +++++++++++++

kernel/time/alarmtimer.c +2 -0

index 8d9f13d847f0..895e3a6d6444 100644
@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
         rtc_timer_cancel(rtc, &rtctimer);
         rtc_read_time(rtc, &tm);
         now = rtc_tm_to_ktime(tm);
+
+       /*

Quoted 9 lines

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 298

Quoted 4 lines

kernel/time/alarmtimer.c +4 -0

+        * If the RTC alarm timer only supports a limited time offset, set
+        * the alarm time to the maximum supported value.
+        * The system will wake up earlier than necessary and is expected
+        * to go back to sleep if it has nothing to do.

Does this assume that the kernel is configured for autosuspend (CONFIG_PM_AUTOSLEEP)? Maybe we should only do this when that config is enabled.

It doesn't really assume anything. It standardizes behavior if the rtc does not support the requested alarm time. Today that either fails or the rtc silently adjusts the alarm time (sometimes to 1 day + 1 minute -> one minute) depending on the implementation in the rtc driver. With this patch in place, the the rtc driver informing the rtc core about the limit, the alarm would fire at the maximum time supported by the rtc if the requested alarm time is larger than its limit.

I see that as improvement, no matter if CONFIG_PM_AUTOSLEEP is enabled or not.

Quoted 9 lines

If userspace is the one autosuspending, then I don't know what we do, or how the kernel knows it is OK. Maybe we need another alarmtimer clock id that will fail creation if the wakeup time is larger than what the rtc can be programmed for? Or maybe that new clock id can have this fixed behavior to wakeup early with the assumption that userspace will go back to sleep, and outdated userspace can use the original alarmtimer clock id if they don't care about suspend failing?

I don't know how to answer this. Again, I see my suggested patch as improvement over not suspending at all or resuming at a more or less random time, which is what you get today depending on the rtc driver.

Actually, I would argue that the above situation applies even if the rtc supports the requested alarm time. Currently, if userspace is the one autosuspending, the system wakes up after the alarm time expires (assuming the rtc supports it). Then what ? Your above question applies to that situation as well and is really independent of the alarm time limit supported by the rtc.

I would agree that various improvements on how to handle the situation where the requested alarm time is larger than the rtc limit may be possible, but I see those as independent and orthogonal to this patch.

Quoted 7 lines

I see another problem too. What do we do if an alarmtimer is created, the rtc device is unregistered, and then we enter suspend? It looks like alarmtimer_suspend() bails out early with no error, so suspend continues. That looks wrong. Presumably we should fail suspend entirely at that point because we'll never be able to wakeup to run the alarmtimer.

Maybe I am missing something, but I think this is equivalent of not having an rtc in the system, or for CONFIG_RTC_CLASS=n. Currently the system just suspends without waking up in those situations. Changing that would be a substantial functional change since suddenly systems without rtc would simply fail to suspend if there is a pending alarm.

Quoting Guenter Roeck (2023-08-30 00:13:09)

Quoted 57 lines · Stephen Boyd

Quoted 38 lines

Quoting Guenter Roeck (2023-08-17 15:55:32)

Quoted 37 lines

Some userspace applications use timerfd_create() to request wakeups after a long period of time. For example, a backup application may request a wakeup once per week. This is perfectly fine as long as the system does not try to suspend. However, if the system tries to suspend and the system's RTC does not support the required alarm timeout, the suspend operation will fail with an error such as

rtc_cmos 00:01: Alarms can be up to one day in the future
PM: dpm_run_callback(): platform_pm_suspend+0x0/0x4a returns -22 alarmtimer alarmtimer.4.auto: platform_pm_suspend+0x0/0x4a returned -22 after 117 usecs
PM: Device alarmtimer.4.auto failed to suspend: error -22

This results in a refusal to suspend the system, causing substantial battery drain on affected systems.

To fix the problem, use the maximum alarm time offset as reported by rtc drivers to set the maximum alarm time. While this will result in brief spurious wakeups from suspend, it is still much better than not suspending at all.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

---
v2: Rename range_max_offset -> alarm_offset_max

   kernel/time/alarmtimer.c | 13 +++++++++++++

kernel/time/alarmtimer.c +2 -0

index 8d9f13d847f0..895e3a6d6444 100644
@@ -290,6 +290,19 @@ static int alarmtimer_suspend(struct device *dev)
          rtc_timer_cancel(rtc, &rtctimer);
          rtc_read_time(rtc, &tm);
          now = rtc_tm_to_ktime(tm);
+
+       /*

Quoted 9 lines

kernel/time/alarmtimer.c static int alarmtimer_suspend(struct device *dev) · line 298

Quoted 4 lines

kernel/time/alarmtimer.c +4 -0

+        * If the RTC alarm timer only supports a limited time offset, set
+        * the alarm time to the maximum supported value.
+        * The system will wake up earlier than necessary and is expected
+        * to go back to sleep if it has nothing to do.

Does this assume that the kernel is configured for autosuspend (CONFIG_PM_AUTOSLEEP)? Maybe we should only do this when that config is enabled.

It doesn't really assume anything. It standardizes behavior if the rtc does not support the requested alarm time. Today that either fails or the rtc silently adjusts the alarm time (sometimes to 1 day + 1 minute -> one minute) depending on the implementation in the rtc driver. With this patch in place, the the rtc driver informing the rtc core about the limit, the alarm would fire at the maximum time supported by the rtc if the requested alarm time is larger than its limit.

Quoted 1 line

I see that as improvement, no matter if CONFIG_PM_AUTOSLEEP is enabled or not.

Agreed. It's an improvement.

The ABI of alarmtimers seem to be "Run this timer at time X, and wake up the system from suspend if necessary to run the timer at time X".

Quoted 14 lines

Quoted 9 lines

If userspace is the one autosuspending, then I don't know what we do, or how the kernel knows it is OK. Maybe we need another alarmtimer clock id that will fail creation if the wakeup time is larger than what the rtc can be programmed for? Or maybe that new clock id can have this fixed behavior to wakeup early with the assumption that userspace will go back to sleep, and outdated userspace can use the original alarmtimer clock id if they don't care about suspend failing?

I don't know how to answer this. Again, I see my suggested patch as improvement over not suspending at all or resuming at a more or less random time, which is what you get today depending on the rtc driver.

Quoted 5 lines

Actually, I would argue that the above situation applies even if the rtc supports the requested alarm time. Currently, if userspace is the one autosuspending, the system wakes up after the alarm time expires (assuming the rtc supports it). Then what ? Your above question applies to that situation as well and is really independent of the alarm time limit supported by the rtc.

The comment in the code is causing me confusion. It says

The system will wake up earlier than necessary and is expected to go back to sleep if it has nothing to do.

I'd reword this to not talk about auto-suspend because the ABI of alarmtimers doesn't concern itself with autosuspend.

The system will wake up earlier (possibly much earlier) than when the alarmtimer runs. This is the best the kernel can do because the alarmtimer exceeds the time that the rtc device can be programmed for.

Quoted 4 lines

I would agree that various improvements on how to handle the situation where the requested alarm time is larger than the rtc limit may be possible, but I see those as independent and orthogonal to this patch.

I certainly hope that userspace isn't relying on the existing behavior.

Quoted 8 lines

Quoted 7 lines

I see another problem too. What do we do if an alarmtimer is created, the rtc device is unregistered, and then we enter suspend? It looks like alarmtimer_suspend() bails out early with no error, so suspend continues. That looks wrong. Presumably we should fail suspend entirely at that point because we'll never be able to wakeup to run the alarmtimer.

Quoted 5 lines

Maybe I am missing something, but I think this is equivalent of not having an rtc in the system, or for CONFIG_RTC_CLASS=n. Currently the system just suspends without waking up in those situations. Changing that would be a substantial functional change since suddenly systems without rtc would simply fail to suspend if there is a pending alarm.

We fail alarmtimer creation in the case that CONFIG_RTC_CLASS=n or when there isn't an rtc. See alarmtimer_get_rtcdev() and how it is called. I doubt it ever really happens in practice, but it looks possible to simulate by unbinding the rtc device driver.

Quoted 5 lines

We fail alarmtimer creation in the case that CONFIG_RTC_CLASS=n or when there isn't an rtc. See alarmtimer_get_rtcdev() and how it is called. I doubt it ever really happens in practice, but it looks possible to simulate by unbinding the rtc device driver.

Thanks for the clarification. That really makes me wonder what happens if an rtc device is unregistered. The .remove_dev callback of alarmtimer_rtc_interface is not populated, and rtc_dev is never cleared. That means unbinding an rtc device driver should result in a crash. Am I missing something ?

RZN1 only supports alarms up to one week in the future. Report the limit to the RTC core and use the reported limit to validate the requested alarm time when setting it.

Cc Brian Norris <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Some alarm timers are based on time offsets, not on absolute times. In some situations, the amount of time that can be scheduled in the future is limited. This may result in a refusal to suspend the system, causing substantial battery drain.

This problem was previously observed on a Chromebook using the cros_ec rtc driver. EC variants on some older Chromebooks only support 24 hours of alarm time in the future. To work around the problem on affected Chromebooks, code to limit the maximum alarm time was added to the cros_ec rtc driver with commit f27efee66370 ("rtc: cros-ec: Limit RTC alarm range if needed"). The problem is now seen again on a system using the cmos RTC driver on hardware limited to 24 hours of alarm time, so a more generic solution is needed.

[...]