| Message ID | 1433217907-928-6-git-send-email-fu.wei@linaro.org |
|---|---|
| State | New |
| Headers | show |
Hi Timur, Thanks , feedback inline On 2 June 2015 at 23:32, Timur Tabi <timur@codeaurora.org> wrote: > On 06/01/2015 11:05 PM, fu.wei@linaro.org wrote: > >> +/* >> + * help functions for accessing 32bit registers of SBSA Generic Watchdog >> + */ >> +static void sbsa_gwdt_cf_write(unsigned int reg, u32 val, >> + struct watchdog_device *wdd) >> +{ >> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >> + >> + writel_relaxed(val, gwdt->control_base + reg); >> +} >> + >> +static void sbsa_gwdt_rf_write(unsigned int reg, u32 val, >> + struct watchdog_device *wdd) >> +{ >> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >> + >> + writel_relaxed(val, gwdt->refresh_base + reg); >> +} >> + >> +static u32 sbsa_gwdt_cf_read(unsigned int reg, struct watchdog_device >> *wdd) >> +{ >> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >> + >> + return readl_relaxed(gwdt->control_base + reg); >> +} > > > I still think you should get rid of these functions and just call > readl_relaxed() and writel_relaxed() every time, but I won't complain again > if you keep them. yes, that make sense, and will reduce the size of code, and I think the code's readability will be OK too. will try in my next patch, > >> +static irqreturn_t sbsa_gwdt_interrupt(int irq, void *dev_id) >> +{ >> + struct sbsa_gwdt *gwdt = (struct sbsa_gwdt *)dev_id; >> + struct watchdog_device *wdd = &gwdt->wdd; >> + >> + if (wdd->pretimeout) >> + /* The pretimeout is valid, go panic */ >> + panic("SBSA Watchdog pre-timeout"); >> + else >> + /* We don't use pretimeout, trigger WS1 now*/ >> + sbsa_gwdt_set_wcv(wdd, 0); > > > I don't like this. If so, what is your idea ,if pretimeout == 0? the reason of using WCV as (timout - pretimeout): it can provide the longer timeout period, (1)If we use WOR, it can only provide 10s @ 400MHz(max). as Guenter said earlier, the default timer out for most watchdog will be 30s, so I think 10s limit will be a little short (2)we can always program WCV just like ping. (3)if a timeout arrives, WOR will be use, so use it as pretimeout, but we still can make this pretimeout longer by programming WCV(I don't think it's necessary) > The triggering of the hardware reset should never depend > on an interrupt being handled properly. if this fail, system reset in 1S, because WOR == (1s) > You should always program WCV > correctly in advance. This is especially true since pre-timeout will > probably rarely be used. always programming WCV is doable. But I absolutely can not agree " pre-timeout will probably rarely be used" If so, SBSA watchdog is just a normal watchdog, This use case just makes this HW useless. If so, go to use SP805. you still don't see the importance of this warning and pretimeout to a real server. If the software of a real server goes wrong, then you just directly restart it , never try to sync/protect the current data, never try to figure out what is wrong with it. I don't think that is a good server software. At least, I don't thinks " pre-timeout will probably rarely be used" is a good idea for a server. in another word, in a server ,pre-timeout should always be used. > So what happens if the CPU is totally hung and Again, system reset in 1S, because WOR == (1s). > this interrupt handler is never called? When will the timeout occur? if this interrupt hardler is never called, what I can see is "some one is feeding the dog". OK, in case, WS0 is triggered, but this interrupt hardler isn't called, then software really goes wrong. Then , Again, Again system reset in 1S, because WOR == (1s). > >> +static int sbsa_gwdt_probe(struct platform_device *pdev) >> +{ >> + u64 first_period_max = U64_MAX; >> + struct device *dev = &pdev->dev; >> + struct watchdog_device *wdd; >> + struct sbsa_gwdt *gwdt; >> + struct resource *res; >> + void *rf_base, *cf_base; >> + int ret, irq; >> + u32 status; >> + >> + gwdt = devm_kzalloc(dev, sizeof(*gwdt), GFP_KERNEL); >> + if (!gwdt) >> + return -ENOMEM; >> + platform_set_drvdata(pdev, gwdt); > > > You should probably do this *after* calling platform_get_irq_byname(). it just dose (pdev->) dev->driver_data = gwdt If we got gwdt, we can do that. But maybe I miss something(or a rule of usage), so please let know why this has to be called *after* calling platform_get_irq_byname(). > >> + >> + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, >> "refresh"); >> + rf_base = devm_ioremap_resource(dev, res); >> + if (IS_ERR(rf_base)) >> + return PTR_ERR(rf_base); >> + >> + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, >> "control"); >> + cf_base = devm_ioremap_resource(dev, res); >> + if (IS_ERR(cf_base)) >> + return PTR_ERR(cf_base); >> + >> + irq = platform_get_irq_byname(pdev, "ws0"); >> + if (irq < 0) { >> + dev_err(dev, "unable to get ws0 interrupt.\n"); >> + return irq; >> + } >> + >> + /* >> + * Get the frequency of system counter from the cp15 interface of >> ARM >> + * Generic timer. We don't need to check it, because if it returns >> "0", >> + * system would panic in very early stage. >> + */ >> + gwdt->clk = arch_timer_get_cntfrq(); >> + gwdt->refresh_base = rf_base; >> + gwdt->control_base = cf_base; >> + >> + wdd = &gwdt->wdd; >> + wdd->parent = dev; >> + wdd->info = &sbsa_gwdt_info; >> + wdd->ops = &sbsa_gwdt_ops; >> + watchdog_set_drvdata(wdd, gwdt); >> + watchdog_set_nowayout(wdd, nowayout); >> + >> + wdd->min_pretimeout = 0; >> + wdd->max_pretimeout = U32_MAX / gwdt->clk; >> + wdd->min_timeout = 1; >> + do_div(first_period_max, gwdt->clk); >> + wdd->max_timeout = first_period_max; >> + >> + wdd->pretimeout = DEFAULT_PRETIMEOUT; >> + wdd->timeout = DEFAULT_TIMEOUT; >> + watchdog_init_timeouts(wdd, pretimeout, timeout, dev); >> + >> + status = sbsa_gwdt_cf_read(SBSA_GWDT_WCS, wdd); >> + if (status & SBSA_GWDT_WCS_WS1) { >> + dev_warn(dev, "System reset by WDT(WCV: %llx)\n", >> + sbsa_gwdt_get_wcv(wdd)); > > > "System was previously reset via watchdog" is much clearer. OK > >> + wdd->bootstatus |= WDIOF_CARDRESET; >> + } >> + /* Check if watchdog is already enabled */ >> + if (status & SBSA_GWDT_WCS_EN) { >> + dev_warn(dev, "already enabled!\n"); > > > "watchdog is already enabled". I think I don't need to print "watchdog", dev_warn(dev, has help us on this. If you do so , the message will be "watchdog: watchdog0: watchdog is already enabled" > Never use exclamation marks in kernel > messages. that make sense , will delete it. > >> + sbsa_gwdt_keepalive(wdd); >> + } >> + >> + /* update pretimeout to WOR */ >> + sbsa_gwdt_set_pretimeout(wdd, wdd->pretimeout); >> + >> + ret = devm_request_irq(dev, irq, sbsa_gwdt_interrupt, 0, >> + pdev->name, gwdt); >> + if (ret) { >> + dev_err(dev, "unable to request IRQ %d\n", irq); >> + return ret; >> + } >> + >> + ret = watchdog_register_device(wdd); >> + if (ret) >> + return ret; >> + >> + dev_info(dev, "Initialized with %ds timeout, %ds pretimeout @ %u >> Hz\n", >> + wdd->timeout, wdd->pretimeout, gwdt->clk); > > > if (wdd->pretimeout) > "watchdog initialized to %us timeout and %us pre-timeout at %u > Hz\n", wdd->timeout, wdd->pretimeout, gwdt->clk > else > "watchdog initialized to %us timeout at %u Hz\n", wdd->timeout, > gwdt->clk > > I think it's unlikely that users will use pre-timeout, so your code should > treat pre-timeout as a special case, not the normal usage. I don't think so, that why you didn't use pretimeout in your driver. Because you don't see the meaning of "pretimeout" to a server. > > -- > Qualcomm Innovation Center, Inc. > The Qualcomm Innovation Center, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project.
Hi Gurnter On 3 June 2015 at 01:07, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/02/2015 09:55 AM, Fu Wei wrote: >> >> Hi Timur, >> >> Thanks , feedback inline >> >> On 2 June 2015 at 23:32, Timur Tabi <timur@codeaurora.org> wrote: >>> >>> On 06/01/2015 11:05 PM, fu.wei@linaro.org wrote: >>> >>>> +/* >>>> + * help functions for accessing 32bit registers of SBSA Generic >>>> Watchdog >>>> + */ >>>> +static void sbsa_gwdt_cf_write(unsigned int reg, u32 val, >>>> + struct watchdog_device *wdd) >>>> +{ >>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>> + >>>> + writel_relaxed(val, gwdt->control_base + reg); >>>> +} >>>> + >>>> +static void sbsa_gwdt_rf_write(unsigned int reg, u32 val, >>>> + struct watchdog_device *wdd) >>>> +{ >>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>> + >>>> + writel_relaxed(val, gwdt->refresh_base + reg); >>>> +} >>>> + >>>> +static u32 sbsa_gwdt_cf_read(unsigned int reg, struct watchdog_device >>>> *wdd) >>>> +{ >>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>> + >>>> + return readl_relaxed(gwdt->control_base + reg); >>>> +} >>> >>> >>> >>> I still think you should get rid of these functions and just call >>> readl_relaxed() and writel_relaxed() every time, but I won't complain >>> again >>> if you keep them. >> >> >> yes, that make sense, and will reduce the size of code, and I think >> the code's readability will be OK too. >> will try in my next patch, >> >>> >>>> +static irqreturn_t sbsa_gwdt_interrupt(int irq, void *dev_id) >>>> +{ >>>> + struct sbsa_gwdt *gwdt = (struct sbsa_gwdt *)dev_id; >>>> + struct watchdog_device *wdd = &gwdt->wdd; >>>> + >>>> + if (wdd->pretimeout) >>>> + /* The pretimeout is valid, go panic */ >>>> + panic("SBSA Watchdog pre-timeout"); >>>> + else >>>> + /* We don't use pretimeout, trigger WS1 now*/ >>>> + sbsa_gwdt_set_wcv(wdd, 0); >>> >>> >>> >>> I don't like this. >> >> >> If so, what is your idea ,if pretimeout == 0? >> >> the reason of using WCV as (timout - pretimeout): it can provide the >> longer timeout period, >> (1)If we use WOR, it can only provide 10s @ 400MHz(max). >> as Guenter said earlier, the default timer out for most watchdog will >> be 30s, so I think 10s limit will be a little short >> (2)we can always program WCV just like ping. >> (3)if a timeout arrives, WOR will be use, so use it as pretimeout, but >> we still can make this pretimeout longer by programming WCV(I don't >> think it's necessary) >> >> >>> The triggering of the hardware reset should never depend >>> on an interrupt being handled properly. >> >> >> if this fail, system reset in 1S, because WOR == (1s) >> > So ? Even the interrupt routine isn't triggered, (WOR + system counter) --> WCV, then, sy system reset in 1S. the hardware reset doesn't depend on an interrupt. > >>> You should always program WCV >>> correctly in advance. This is especially true since pre-timeout will >>> probably rarely be used. >> >> >> always programming WCV is doable. But I absolutely can not agree " >> pre-timeout will probably rarely be used" >> If so, SBSA watchdog is just a normal watchdog, This use case just >> makes this HW useless. >> If so, go to use SP805. >> you still don't see the importance of this warning and pretimeout to a >> real server. >> > > If pretimeout isn't used, why not just set WCV = timeout, WOR = 0 ? Because if WOR = 0 , according to SBSA, once you want to enable watchdog, (0 + system counter) --> WCV , then , WS0 and WS1 will be triggered immediately. we have not a chance(a time slot) to update WCV. > > Guenter > > >> If the software of a real server goes wrong, then you just directly >> restart it , >> never try to sync/protect the current data, never try to figure out >> what is wrong with it. >> I don't think that is a good server software. >> >> At least, I don't thinks " pre-timeout will probably rarely be used" >> is a good idea for a server. >> in another word, in a server ,pre-timeout should always be used. >> >>> So what happens if the CPU is totally hung and >> >> >> Again, system reset in 1S, because WOR == (1s). >> >>> this interrupt handler is never called? When will the timeout occur? >> >> >> if this interrupt hardler is never called, what I can see is "some >> one is feeding the dog". >> OK, in case, WS0 is triggered, but this interrupt hardler isn't >> called, then software really goes wrong. Then , Again, Again system >> reset in 1S, because WOR == (1s). >> >>> >>>> +static int sbsa_gwdt_probe(struct platform_device *pdev) >>>> +{ >>>> + u64 first_period_max = U64_MAX; >>>> + struct device *dev = &pdev->dev; >>>> + struct watchdog_device *wdd; >>>> + struct sbsa_gwdt *gwdt; >>>> + struct resource *res; >>>> + void *rf_base, *cf_base; >>>> + int ret, irq; >>>> + u32 status; >>>> + >>>> + gwdt = devm_kzalloc(dev, sizeof(*gwdt), GFP_KERNEL); >>>> + if (!gwdt) >>>> + return -ENOMEM; >>>> + platform_set_drvdata(pdev, gwdt); >>> >>> >>> >>> You should probably do this *after* calling platform_get_irq_byname(). >> >> >> it just dose (pdev->) dev->driver_data = gwdt >> If we got gwdt, we can do that. >> >> But maybe I miss something(or a rule of usage), so please let know >> why this has to be called *after* calling platform_get_irq_byname(). >> >>> >>>> + >>>> + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, >>>> "refresh"); >>>> + rf_base = devm_ioremap_resource(dev, res); >>>> + if (IS_ERR(rf_base)) >>>> + return PTR_ERR(rf_base); >>>> + >>>> + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, >>>> "control"); >>>> + cf_base = devm_ioremap_resource(dev, res); >>>> + if (IS_ERR(cf_base)) >>>> + return PTR_ERR(cf_base); >>>> + >>>> + irq = platform_get_irq_byname(pdev, "ws0"); >>>> + if (irq < 0) { >>>> + dev_err(dev, "unable to get ws0 interrupt.\n"); >>>> + return irq; >>>> + } >>>> + >>>> + /* >>>> + * Get the frequency of system counter from the cp15 interface >>>> of >>>> ARM >>>> + * Generic timer. We don't need to check it, because if it >>>> returns >>>> "0", >>>> + * system would panic in very early stage. >>>> + */ >>>> + gwdt->clk = arch_timer_get_cntfrq(); >>>> + gwdt->refresh_base = rf_base; >>>> + gwdt->control_base = cf_base; >>>> + >>>> + wdd = &gwdt->wdd; >>>> + wdd->parent = dev; >>>> + wdd->info = &sbsa_gwdt_info; >>>> + wdd->ops = &sbsa_gwdt_ops; >>>> + watchdog_set_drvdata(wdd, gwdt); >>>> + watchdog_set_nowayout(wdd, nowayout); >>>> + >>>> + wdd->min_pretimeout = 0; >>>> + wdd->max_pretimeout = U32_MAX / gwdt->clk; >>>> + wdd->min_timeout = 1; >>>> + do_div(first_period_max, gwdt->clk); >>>> + wdd->max_timeout = first_period_max; >>>> + >>>> + wdd->pretimeout = DEFAULT_PRETIMEOUT; >>>> + wdd->timeout = DEFAULT_TIMEOUT; >>>> + watchdog_init_timeouts(wdd, pretimeout, timeout, dev); >>>> + >>>> + status = sbsa_gwdt_cf_read(SBSA_GWDT_WCS, wdd); >>>> + if (status & SBSA_GWDT_WCS_WS1) { >>>> + dev_warn(dev, "System reset by WDT(WCV: %llx)\n", >>>> + sbsa_gwdt_get_wcv(wdd)); >>> >>> >>> >>> "System was previously reset via watchdog" is much clearer. >> >> >> OK >> >>> >>>> + wdd->bootstatus |= WDIOF_CARDRESET; >>>> + } >>>> + /* Check if watchdog is already enabled */ >>>> + if (status & SBSA_GWDT_WCS_EN) { >>>> + dev_warn(dev, "already enabled!\n"); >>> >>> >>> >>> "watchdog is already enabled". >> >> >> I think I don't need to print "watchdog", dev_warn(dev, has help us on >> this. >> If you do so , the message will be "watchdog: watchdog0: watchdog is >> already enabled" >> >> > Never use exclamation marks in kernel >>> >>> messages. >> >> >> that make sense , will delete it. >> >>> >>>> + sbsa_gwdt_keepalive(wdd); >>>> + } >>>> + >>>> + /* update pretimeout to WOR */ >>>> + sbsa_gwdt_set_pretimeout(wdd, wdd->pretimeout); >>>> + >>>> + ret = devm_request_irq(dev, irq, sbsa_gwdt_interrupt, 0, >>>> + pdev->name, gwdt); >>>> + if (ret) { >>>> + dev_err(dev, "unable to request IRQ %d\n", irq); >>>> + return ret; >>>> + } >>>> + >>>> + ret = watchdog_register_device(wdd); >>>> + if (ret) >>>> + return ret; >>>> + >>>> + dev_info(dev, "Initialized with %ds timeout, %ds pretimeout @ %u >>>> Hz\n", >>>> + wdd->timeout, wdd->pretimeout, gwdt->clk); >>> >>> >>> >>> if (wdd->pretimeout) >>> "watchdog initialized to %us timeout and %us pre-timeout at %u >>> Hz\n", wdd->timeout, wdd->pretimeout, gwdt->clk >>> else >>> "watchdog initialized to %us timeout at %u Hz\n", wdd->timeout, >>> gwdt->clk >>> >>> I think it's unlikely that users will use pre-timeout, so your code >>> should >>> treat pre-timeout as a special case, not the normal usage. >> >> >> I don't think so, that why you didn't use pretimeout in your driver. >> Because you don't see the meaning of "pretimeout" to a server. >> >>> >>> -- >>> Qualcomm Innovation Center, Inc. >>> The Qualcomm Innovation Center, Inc. is a member of the >>> Code Aurora Forum, a Linux Foundation Collaborative Project. >> >> >> >> >
Hi Guenter, On 4 June 2015 at 02:25, Guenter Roeck <linux@roeck-us.net> wrote: > On Wed, Jun 03, 2015 at 01:16:41PM -0500, Timur Tabi wrote: >> On 06/01/2015 11:05 PM, fu.wei@linaro.org wrote: >> >+ if (wdd->pretimeout) >> >+ /* The pretimeout is valid, go panic */ >> >+ panic("SBSA Watchdog pre-timeout"); >> >> The problem with this is that WS1 will still occur. So a few seconds after >> the panic() call, the hardware will reset. There won't be any time to debug >> or log anything. >> > > In general the idea here would be to use a crashdump kernel, which, > when loaded, would reset the watchdog before it fires. This kernel > would then write a core dump to a specified location. > > If arm64 doesn't support a crashdump kernel, it might still be possible > to log the backtrace somewhere (eg in nvram using pstore if that is > supported via acpi or efi). yes, you are right , thanks for explaining this. > > Is there reason to believe that this all won't work on arm64 ? I don't think there is a reason. > > Thanks, > Guenter
Hi Guenter, On 9 June 2015 at 02:26, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/08/2015 09:05 AM, Fu Wei wrote: >> >> Hi Gurnter >> >> On 3 June 2015 at 01:07, Guenter Roeck <linux@roeck-us.net> wrote: >>> >>> On 06/02/2015 09:55 AM, Fu Wei wrote: >>>> >>>> >>>> Hi Timur, >>>> >>>> Thanks , feedback inline >>>> >>>> On 2 June 2015 at 23:32, Timur Tabi <timur@codeaurora.org> wrote: >>>>> >>>>> >>>>> On 06/01/2015 11:05 PM, fu.wei@linaro.org wrote: >>>>> >>>>>> +/* >>>>>> + * help functions for accessing 32bit registers of SBSA Generic >>>>>> Watchdog >>>>>> + */ >>>>>> +static void sbsa_gwdt_cf_write(unsigned int reg, u32 val, >>>>>> + struct watchdog_device *wdd) >>>>>> +{ >>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>> + >>>>>> + writel_relaxed(val, gwdt->control_base + reg); >>>>>> +} >>>>>> + >>>>>> +static void sbsa_gwdt_rf_write(unsigned int reg, u32 val, >>>>>> + struct watchdog_device *wdd) >>>>>> +{ >>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>> + >>>>>> + writel_relaxed(val, gwdt->refresh_base + reg); >>>>>> +} >>>>>> + >>>>>> +static u32 sbsa_gwdt_cf_read(unsigned int reg, struct watchdog_device >>>>>> *wdd) >>>>>> +{ >>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>> + >>>>>> + return readl_relaxed(gwdt->control_base + reg); >>>>>> +} >>>>> >>>>> >>>>> >>>>> >>>>> I still think you should get rid of these functions and just call >>>>> readl_relaxed() and writel_relaxed() every time, but I won't complain >>>>> again >>>>> if you keep them. >>>> >>>> >>>> >>>> yes, that make sense, and will reduce the size of code, and I think >>>> the code's readability will be OK too. >>>> will try in my next patch, >>>> >>>>> >>>>>> +static irqreturn_t sbsa_gwdt_interrupt(int irq, void *dev_id) >>>>>> +{ >>>>>> + struct sbsa_gwdt *gwdt = (struct sbsa_gwdt *)dev_id; >>>>>> + struct watchdog_device *wdd = &gwdt->wdd; >>>>>> + >>>>>> + if (wdd->pretimeout) >>>>>> + /* The pretimeout is valid, go panic */ >>>>>> + panic("SBSA Watchdog pre-timeout"); >>>>>> + else >>>>>> + /* We don't use pretimeout, trigger WS1 now*/ >>>>>> + sbsa_gwdt_set_wcv(wdd, 0); >>>>> >>>>> >>>>> >>>>> >>>>> I don't like this. >>>> >>>> >>>> >>>> If so, what is your idea ,if pretimeout == 0? >>>> >>>> the reason of using WCV as (timout - pretimeout): it can provide the >>>> longer timeout period, >>>> (1)If we use WOR, it can only provide 10s @ 400MHz(max). >>>> as Guenter said earlier, the default timer out for most watchdog will >>>> be 30s, so I think 10s limit will be a little short >>>> (2)we can always program WCV just like ping. >>>> (3)if a timeout arrives, WOR will be use, so use it as pretimeout, but >>>> we still can make this pretimeout longer by programming WCV(I don't >>>> think it's necessary) >>>> >>>> >>>>> The triggering of the hardware reset should never depend >>>>> on an interrupt being handled properly. >>>> >>>> >>>> >>>> if this fail, system reset in 1S, because WOR == (1s) >>>> >>> So ? >> >> >> Even the interrupt routine isn't triggered, (WOR + system counter) --> >> WCV, >> then, sy system reset in 1S. >> >> the hardware reset doesn't depend on an interrupt. >> >> >>> >>>>> You should always program WCV >>>>> correctly in advance. This is especially true since pre-timeout will >>>>> probably rarely be used. >>>> >>>> >>>> >>>> always programming WCV is doable. But I absolutely can not agree " >>>> pre-timeout will probably rarely be used" >>>> If so, SBSA watchdog is just a normal watchdog, This use case just >>>> makes this HW useless. >>>> If so, go to use SP805. >>>> you still don't see the importance of this warning and pretimeout to a >>>> real server. >>>> >>> >>> If pretimeout isn't used, why not just set WCV = timeout, WOR = 0 ? >> >> >> Because if WOR = 0 , according to SBSA, once you want to enable watchdog, >> (0 + system counter) --> WCV , then , WS0 and WS1 will be triggered >> immediately. >> we have not a chance(a time slot) to update WCV. >> > > I would have thought that this is exactly what we want if pretimeout is not > used. Although pretimeout == 0 is not good for a server, but If administrator set up pretimeout == 0. *I thinks we should trigger WS1 ASAP* . Because WS1 maybe a interrupter or a reboot signal, that is why we can not reboot system directly. This driver is SBSA watchdog driver, that means we need to follow SBSA spec: (1) SBSA watchdog has two stage timeouts --> timeout and pretimeout is the best solution in watchdog framework, at least for now. (2) The watchdog has the following output signals: Watchdog Signal 0 (WS0)---> "The initial signal is typically wired to an interrupt and alerts the system."(original word from spec), I thinks the key work should be "interrupt" and "alerts". So in WS0 interrupt routine, reset is absolutely a wrong operation. Although I think we should make this "alerts" more useful. But for the first version of driver, I thinks panic is useful enough. Watchdog Signal 1 (WS1). ---> "The signal is fed to a higher agent as an interrupt or reset for it to take executive action." (original word from spec) . The key work should be "interrupt", "or" and "reset" . So WS1 maybe a interrupt. so even in the WS0 interrupt routine, if pretimeout == 0 , we need to trigger WS1(that is what my patch is doing now, set WCV to 0, so WCV is always less than SystemCounter, and in this situation(WS0 = TRUE), WS1 will be trigger immediately), but definitely not a reset too. But in worst case, if the WS0 is triggered, but the interrupt routine doesn't work(can not set up WCV), it doesn't matter, we just need to wait for a WOR(1s in my driver) timeout, then WS1 will be triggered. That is hardware mechanism, once we config SBSA watchdog correctly, that should work. If it doesn't, I think the chip design doesn't follow the SBSA spec. Make a summary here, for SBSA watchdog driver, it need to support two stage timeouts and need to trigger WS0/1 when timeouts occur(can not simply reset system in interrupt routines). If a driver doesn't do these above, the driver can not be called SBSA watchdog driver. But according to SBSA, even pretimeout == 0, we can not setup WOR = 0. if we make WOR = 0 , once we set up WCS(enabling watchdog), that cause a explicit watchdog refresh, then WCV = (0 + system counter), so WS0 and WS1 will be triggered serially and immediately(in theory, the "delay" also depend on implementation). So in my patchset , if pretimeout == 0, WOR will be 1s at least to make sure we have time to setup WCV. I have made comments in the patch for explaining this. Maybe some people want to ask: if we can not set up WOR = 0, but pretimeout can be 0 and timeout can not, why I still want to use WOR for pretimeout and using WCV as (timout - pretimeout) ?? For this: (1)WCV can provide the longer timeout period, If we use WOR, it can only provide 10s @ 400MHz(max). The default timer out for most watchdog will be 30s, so I think 10s limit will be a little short. (2)we can always program(write) WCV just like ping. (3)if the first timeout occurs, WOR will be loaded to WCV(WOR + system counter) automatically , so why not just use WOR as pretimeout? Although we still can make this pretimeout longer by programming WCV, I don't think it's necessary for now. > What am I missing here ? > > Guenter >
Hi Guenter, Thanks for reply so quickly. On 9 June 2015 at 12:37, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/08/2015 08:59 PM, Fu Wei wrote: >> >> Hi Guenter, >> >> >> On 9 June 2015 at 02:26, Guenter Roeck <linux@roeck-us.net> wrote: >>> >>> On 06/08/2015 09:05 AM, Fu Wei wrote: >>>> >>>> >>>> Hi Gurnter >>>> >>>> On 3 June 2015 at 01:07, Guenter Roeck <linux@roeck-us.net> wrote: >>>>> >>>>> >>>>> On 06/02/2015 09:55 AM, Fu Wei wrote: >>>>>> >>>>>> >>>>>> >>>>>> Hi Timur, >>>>>> >>>>>> Thanks , feedback inline >>>>>> >>>>>> On 2 June 2015 at 23:32, Timur Tabi <timur@codeaurora.org> wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> On 06/01/2015 11:05 PM, fu.wei@linaro.org wrote: >>>>>>> >>>>>>>> +/* >>>>>>>> + * help functions for accessing 32bit registers of SBSA Generic >>>>>>>> Watchdog >>>>>>>> + */ >>>>>>>> +static void sbsa_gwdt_cf_write(unsigned int reg, u32 val, >>>>>>>> + struct watchdog_device *wdd) >>>>>>>> +{ >>>>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>>>> + >>>>>>>> + writel_relaxed(val, gwdt->control_base + reg); >>>>>>>> +} >>>>>>>> + >>>>>>>> +static void sbsa_gwdt_rf_write(unsigned int reg, u32 val, >>>>>>>> + struct watchdog_device *wdd) >>>>>>>> +{ >>>>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>>>> + >>>>>>>> + writel_relaxed(val, gwdt->refresh_base + reg); >>>>>>>> +} >>>>>>>> + >>>>>>>> +static u32 sbsa_gwdt_cf_read(unsigned int reg, struct >>>>>>>> watchdog_device >>>>>>>> *wdd) >>>>>>>> +{ >>>>>>>> + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); >>>>>>>> + >>>>>>>> + return readl_relaxed(gwdt->control_base + reg); >>>>>>>> +} >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> I still think you should get rid of these functions and just call >>>>>>> readl_relaxed() and writel_relaxed() every time, but I won't complain >>>>>>> again >>>>>>> if you keep them. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> yes, that make sense, and will reduce the size of code, and I think >>>>>> the code's readability will be OK too. >>>>>> will try in my next patch, >>>>>> >>>>>>> >>>>>>>> +static irqreturn_t sbsa_gwdt_interrupt(int irq, void *dev_id) >>>>>>>> +{ >>>>>>>> + struct sbsa_gwdt *gwdt = (struct sbsa_gwdt *)dev_id; >>>>>>>> + struct watchdog_device *wdd = &gwdt->wdd; >>>>>>>> + >>>>>>>> + if (wdd->pretimeout) >>>>>>>> + /* The pretimeout is valid, go panic */ >>>>>>>> + panic("SBSA Watchdog pre-timeout"); >>>>>>>> + else >>>>>>>> + /* We don't use pretimeout, trigger WS1 now*/ >>>>>>>> + sbsa_gwdt_set_wcv(wdd, 0); >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> I don't like this. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> If so, what is your idea ,if pretimeout == 0? >>>>>> >>>>>> the reason of using WCV as (timout - pretimeout): it can provide the >>>>>> longer timeout period, >>>>>> (1)If we use WOR, it can only provide 10s @ 400MHz(max). >>>>>> as Guenter said earlier, the default timer out for most watchdog will >>>>>> be 30s, so I think 10s limit will be a little short >>>>>> (2)we can always program WCV just like ping. >>>>>> (3)if a timeout arrives, WOR will be use, so use it as pretimeout, but >>>>>> we still can make this pretimeout longer by programming WCV(I don't >>>>>> think it's necessary) >>>>>> >>>>>> >>>>>>> The triggering of the hardware reset should never depend >>>>>>> on an interrupt being handled properly. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> if this fail, system reset in 1S, because WOR == (1s) >>>>>> >>>>> So ? >>>> >>>> >>>> >>>> Even the interrupt routine isn't triggered, (WOR + system counter) --> >>>> WCV, >>>> then, sy system reset in 1S. >>>> >>>> the hardware reset doesn't depend on an interrupt. >>>> >>>> >>>>> >>>>>>> You should always program WCV >>>>>>> correctly in advance. This is especially true since pre-timeout will >>>>>>> probably rarely be used. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> always programming WCV is doable. But I absolutely can not agree " >>>>>> pre-timeout will probably rarely be used" >>>>>> If so, SBSA watchdog is just a normal watchdog, This use case just >>>>>> makes this HW useless. >>>>>> If so, go to use SP805. >>>>>> you still don't see the importance of this warning and pretimeout to a >>>>>> real server. >>>>>> >>>>> >>>>> If pretimeout isn't used, why not just set WCV = timeout, WOR = 0 ? >>>> >>>> >>>> >>>> Because if WOR = 0 , according to SBSA, once you want to enable >>>> watchdog, >>>> (0 + system counter) --> WCV , then , WS0 and WS1 will be triggered >>>> immediately. >>>> we have not a chance(a time slot) to update WCV. >>>> >>> >>> I would have thought that this is exactly what we want if pretimeout is >>> not >>> used. >> >> >> Although pretimeout == 0 is not good for a server, but If >> administrator set up pretimeout == 0. *I thinks we should trigger WS1 >> ASAP* . Because WS1 maybe a interrupter or a reboot signal, that is >> why we can not reboot system directly. >> >> This driver is SBSA watchdog driver, that means we need to follow SBSA >> spec: >> (1) SBSA watchdog has two stage timeouts --> timeout and pretimeout is >> the best solution in watchdog framework, at least for now. >> (2) The watchdog has the following output signals: >> Watchdog Signal 0 (WS0)---> "The initial signal is typically wired >> to an interrupt and alerts the system."(original word from spec), I >> thinks the key work should be "interrupt" and "alerts". So in WS0 >> interrupt routine, reset is absolutely a wrong operation. Although I >> think we should make this "alerts" more useful. But for the first >> version of driver, I thinks panic is useful enough. >> Watchdog Signal 1 (WS1). ---> "The signal is fed to a higher agent >> as an interrupt or reset for it to take executive action." (original >> word from spec) . The key work should be "interrupt", "or" and "reset" >> . So WS1 maybe a interrupt. >> so even in the WS0 interrupt routine, if pretimeout == 0 , we need to >> trigger WS1(that is what my patch is doing now, set WCV to 0, so WCV >> is always less than SystemCounter, and in this situation(WS0 = TRUE), >> WS1 will be trigger immediately), but definitely not a reset too. >> >> But in worst case, if the WS0 is triggered, but the interrupt routine >> doesn't work(can not set up WCV), it doesn't matter, we just need to >> wait for a WOR(1s in my driver) timeout, then WS1 will be triggered. >> That is hardware mechanism, once we config SBSA watchdog correctly, >> that should work. If it doesn't, I think the chip design doesn't >> follow the SBSA spec. >> >> Make a summary here, for SBSA watchdog driver, it need to support two >> stage timeouts and need to trigger WS0/1 when timeouts occur(can not >> simply reset system in interrupt routines). >> If a driver doesn't do these above, the driver can not be called SBSA >> watchdog driver. >> >> But according to SBSA, even pretimeout == 0, we can not setup WOR = 0. >> if we make WOR = 0 , once we set up WCS(enabling watchdog), that cause >> a explicit watchdog refresh, then WCV = (0 + system counter), so WS0 >> and WS1 will be triggered serially and immediately(in theory, the > > > I still don't understand why this would be a problem. that 20+ lines pseudocode from the page 23 of SBSA spec 2.3 can explain this well. Please let me know which line confuse you, I will explain them one by one below. > >> "delay" also depend on implementation). So in my patchset , if >> pretimeout == 0, WOR will be 1s at least to make sure we have time to >> setup WCV. I have made comments in the patch for explaining this. >> >> Maybe some people want to ask: if we can not set up WOR = 0, but >> pretimeout can be 0 and timeout can not, why I still want to use WOR >> for pretimeout and using WCV as (timout - pretimeout) ?? >> For this: >> (1)WCV can provide the longer timeout period, If we use WOR, it can >> only provide 10s @ 400MHz(max). The default timer out for most >> watchdog will be 30s, so I think 10s limit will be a little short. >> (2)we can always program(write) WCV just like ping. >> (3)if the first timeout occurs, WOR will be loaded to WCV(WOR + system >> counter) automatically , so why not just use WOR as pretimeout? >> Although we still can make this pretimeout longer by programming WCV, >> I don't think it's necessary for now. >> > > Too bad I don't have an arm64 system to test myself. I am not sure > I understand why WOR must be set to > 0 if pretimeout == 0, and even Although SBSA spec has published for years(2.2 was published at 15th Jan 2014), but this is still a relatively new spec of hardware, for now . I only has Foundation model and FAST model for testing. But I would like to suggest: this driver should follow the SBSA spec first, but not a specific hardware, even some of hardware has this watchdog, but there maybe some hardware bug in it(at least I know there is one). I am using 1 second, just because I think 1 second is safe enough to reload WCV. (from write "1" in WCS to reload WCV[31:0] and WCV[63:32] ) Actually, in most of case , we need WOR > 1, only when we enable the watchdog( write "1" to WCS, this causes a ExplicitRefresh, see Line 7 "ExplicitRefresh == TRUE" and Line 8 below). in this cause , we just need a time slot to reload WCV, the driver doesn't really spend 1s on this. But If WOR ==0, (Line 1) TimeoutRefresh = TRUE in a very short time, the minimum time depends on the implementation. Then The first timeout stage occur(see Line 7 (TimeoutRefresh == TRUE and WS0 == FALSE), and Line 8 below again ) and WS0 was triggered(Line 16~18). Because WOR ==0 too, (Line 1) TimeoutRefresh = TRUE occur in a very short time again, then see Line 16, 17, 20 In worst case, if pretimeout is 0, First timeout stage occur(see Line 7 (TimeoutRefresh == TRUE and WS0 == FALSE), and Line 8 below, then Line 16~18) but the interrupt routine doesn't work, we can still got WS1 in the time we configured in WOR. (Line 1) TimeoutRefresh = TRUE occur when SystemCounter[63:0] > SystemCounter[63:0] + ZeroExtend(WOR[31:0]), then Line 16, 17, 20 --------------------------------------------------- CompareValue : WCV WatchdogOffsetValue : WOR 1 TimeoutRefresh = (SystemCounter[63:0] > CompareValue[63:0]) 2 If WatchdogColdReset 3 WatchdogEnable = DISABLED 4 Endif 5 If LoadNewCompareValue 6 CompareValue = new_value 7 ElseIf ExplicitRefresh == TRUE or (TimeoutRefresh == TRUE and WS0 == FALSE) 8 CompareValue = SystemCounter[63:0] + ZeroExtend(WatchdogOffsetValue[31:0]) 9 Endif 10 If WatchdogEnable == DISABLED 11 WS0 = FALSE 12 WS1 = FALSE 13 ElseIf ExplicitRefresh == TRUE 14 WS0 = FALSE 15 WS1 = FALSE 16 ElseIf TimeoutRefresh == TRUE 17 If WS0 == FALSE 18 WS0 = TRUE 19 Else 20 WS1 = TRUE 21 Endif 22 Endif --------------------------------------------------- I would like to stress that pretimeout == 0 should not happen in a real server system, that is why we defined a SBSA watchdog, but not a normal one But we still need to thinking about the situation that administrator want to do this on a very special purpose. maybe we can set min_pretimeout = 1 for this driver. that is just a suggestion. > if it must be set to a value > 0 I don't understand why > setting it to 1 (instead of 1 second) would not be sufficient. it don't have to be 1 second , it can be 0.1, 0.5 or 0.01 second. like I said before, we just need a time slot to setup WCV in sbsa_gwdt_start. I have commented this in sbsa_gwdt_set_pretimeout in this patchset. But I think the minimum time slot depend on implementation, the spec doesn't mention about this. If pretimeout == 0, and we set up WOR a little bigger, it *ONLY* affect "the worst case" I mention above. in this case, a administrator set up pretimeout == 0 which should not happen in a real server, then the system goes very wrong. I don't think it is important that this server system reset in 1 second or 0.0001 second, at this time, this server can not provide any useful info anyway(because we don't use pretimeout). If system may go wrong, the administrator should set up pretimeout > 0 to figure out what is wrong with it just like he always should do. > > Guenter >
Hi Guenter, Thanks for your feedback On 9 June 2015 at 16:04, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/08/2015 11:37 PM, Fu Wei wrote: > >> >> I would like to stress that pretimeout == 0 should not happen in a >> real server system, that is why we defined a SBSA watchdog, but not >> a normal one > > > Clarification - In _your opinion_, a server should always use pretimeout. > >> But we still need to thinking about the situation that administrator >> want to do this on a very special purpose. >> > I could as well argue that setting pretimeout is the special situation. > Some administrators may not want to bother but just want the system to reset > if a watchdog timeout occurs. _Maybe_ if it happens multiple times, > they might want to set up pretimeout to figure out why. you are right, before this driver and device are really used in some server, we don't know How do administrators use this pretimeout, and the percentage of using pretimeout, But here you did mention a good usage of pretimeout: we can figure out what is wrong with system. except the usages, this two stage timeouts is a main feature of SBSA watchdog, if we drop this feature, I don't think that is a SBSA watchdog driver. it becomes normal watchdog driver using SBSA watchdog hardware. > > Declaring that one _has_ to configure pretimeout is just a personal > opinion, nothing else. We don't know what server administrators want, > and we should not dictate anything unless technically necessary. yes, agree with you on "we should not dictate anything unless technically necessary." > >> maybe we can set min_pretimeout = 1 for this driver. that is just a >> suggestion. >> > No. It is not technically necessary. it is just a thought. but I never do that , because min_pretimeout = 0 is technically doable in this driver. > >> >>> if it must be set to a value > 0 I don't understand why >>> setting it to 1 (instead of 1 second) would not be sufficient. >> >> >> it don't have to be 1 second , it can be 0.1, 0.5 or 0.01 second. like >> I said before, we just need a time slot to setup WCV in >> sbsa_gwdt_start. I have commented this in sbsa_gwdt_set_pretimeout in >> this patchset. > > > I think what you really want to say is that you want to have time to > handle the interrupt. But handling the interrupt is not asked for if > pretimeout == 0. No, that is not what I want to say. pretimeout == 0 but WOR can not be 0 is nothing to do with interrupt. In another word, pretimeout == 0 we should trigger WS1 ASAP, we don't need to handle the interrupt. I have explained this in previous email: " we need WOR > 1, only when we enable the watchdog( write "1" to WCS, this causes a ExplicitRefresh, see Line 7 "ExplicitRefresh == TRUE" and Line 8 below). in this cause , we just need a time slot to reload WCV, the driver doesn't really spend 1s on this. But If WOR ==0, (Line 1) TimeoutRefresh = TRUE in a very short time, the minimum time depends on the implementation. Then The first timeout stage occur(see Line 7 (TimeoutRefresh == TRUE and WS0 == FALSE), and Line 8 below again ) and WS0 was triggered(Line 16~18). Because WOR ==0 too, (Line 1) TimeoutRefresh = TRUE occur in a very short time again, then see Line 16, 17, 20 " in one word, according to SBSA, If we make WOR == 0, once we enable watchdog, WS0 and WS1 will be triggered immediately, we have not chance to set up WCV for (timeout - pretimeout). In another word, WOR == 0, we can not enable watchdog, enabling become a warn reset button. > >> But I think the minimum time slot depend on implementation, the spec >> doesn't mention about this. > > > Yes, because a minimum value does not exist. > >> If pretimeout == 0, and we set up WOR a little bigger, it *ONLY* >> affect "the worst case" I mention above. in this case, a administrator >> set up pretimeout == 0 which should not happen in a real server, then >> the system goes very wrong. I don't think it is important that this >> server system reset in 1 second or 0.0001 second, at this time, this >> server can not provide any useful info anyway(because we don't use >> pretimeout). >> If system may go wrong, the administrator should set up pretimeout > >> 0 to figure out what is wrong with it just like he always should do. >> > > Yes, exactly. But otherwise, if pretimeout is set to 0, we want > to reset immediately as directed. In this driver, if pretimeout is set to 0, we want to *trigger WS1* immediately as directed. Yes, If we could. > > As I interpret the specification, WOR=0 forces WS1 immediately after WS0. > > 1) if TimeoutRefresh = True: > CompareValue := SystemCounter + WOR (= SystemCounter > WS0 := True > 2) TimeoutRefresh is True again, WS0 == True: > WS1 = True > > This is exactly the behavior we want if pretimeout == 0. In this situation, > we don't want to handle the interrupt, we just want to reset the system as > fast as possible. Yes, if WOR only affect in TimeoutRefresh, we cat always make WOR == pretimeout But the problem is if we enable watchdog (write 0x01 to WCS will cause an explicit watchdog refresh), then 1) if ExplicitRefresh = True: CompareValue := SystemCounter + WOR WS0 := True 2) TimeoutRefresh is True again, WS0 == True: WS1 = True so once we enable watchdog, system reset, that is not what we want. this behavior is following SBSA spec. FYI: ----- An explicit watchdog refresh occurs when one of a number of different events occur: The Watchdog Refresh Register is written. The Watchdog Offset Register is written. The Watchdog Control and Status register is written. ----- > > Having said that, have you tested what happens in your system if you > set WOR=0 ? I have not HW, but I have tested it on Foundation model, the result is just what I expect: ------------------------------------- pretimeout=0 , and static int sbsa_gwdt_set_pretimeout(struct watchdog_device *wdd, unsigned int pretimeout) { struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); wdd->pretimeout = pretimeout; /* refresh the WOR, that will cause an explicit watchdog refresh */ sbsa_gwdt_cf_write(SBSA_GWDT_WOR, pretimeout * gwdt->clk, wdd); return 0; } ------------------------------------- Once I enable watchdog, system down(there is a WS1 interrupter in Foundation model, but not more info for that), there is not panic(if ws0 is triggered). > > Thanks, > Guenter >
Hi Guenter, On 10 June 2015 at 00:45, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/09/2015 09:29 AM, Timur Tabi wrote: >> >> On 06/09/2015 11:22 AM, Guenter Roeck wrote: >>> >>> >>> >>> but I see your point. Essentially, the specification is broken >>> for all practical purposes, since, as you point out, enabling >>> the watchdog overwrites and explicitly sets WCV. Effectively >>> this means that just using WCV to program the timeout period >>> is not really possible. >>> >>> I am not really sure how to address this. We can either only use WOR, >>> and forget about pretimeout, or we can enforce a minimum pretimeout. >>> In the latter case, we'll have to write WCV after writing WOR. >> >> >> In talking with our hardware engineers, using WCV to program the timeout >> period is not a valid operation. This is why I keep arguing against the >> pre-timeout feature, and I don't agree that servers should always use >> pre-timeout. >> > > Not sure if "not valid" is correct - after all, it is mentioned in the > specification. However, it is at the very least fragile. I think we should focus on SBSA spec, but not a specific chip design, because this is SBSA watchdog, not a driver for an IP core from a specific chip vendor. this operation is mentioned in the spec, and I have tested my driver on Foundation model(from ARM) and a real hardware. > > I tend to agree that we should just forget about pretimeout and > use your original approach, where the timeout value is used > to program WOR. Everything else is really just asking for trouble. I don't mind if we give up pretimeout, The reason I use pretimeout is: this concept matches the function of two stage timeouts. but, If we give up pretimeout, could you give me a suggestion: How to config the two stage timeouts (1)from enabling watchdog to WS0 (2)the time from WS1 to WS0 If we only have one timeout parameter, How to config the two stage timeouts? Any suggestion ? If we make the first stage timeout is timeout/2, this violates the definition of timeout. I don't think users expect interrupt, panic or reboot at timeout/2. And WS1 definitely isn't a backup of WS0. > > Guenter >
Hi Guenter, On 10 June 2015 at 11:41, Fu Wei <fu.wei@linaro.org> wrote: > Hi Guenter, > > On 10 June 2015 at 00:45, Guenter Roeck <linux@roeck-us.net> wrote: >> On 06/09/2015 09:29 AM, Timur Tabi wrote: >>> >>> On 06/09/2015 11:22 AM, Guenter Roeck wrote: >>>> >>>> >>>> >>>> but I see your point. Essentially, the specification is broken >>>> for all practical purposes, since, as you point out, enabling >>>> the watchdog overwrites and explicitly sets WCV. Effectively >>>> this means that just using WCV to program the timeout period >>>> is not really possible. >>>> >>>> I am not really sure how to address this. We can either only use WOR, >>>> and forget about pretimeout, or we can enforce a minimum pretimeout. >>>> In the latter case, we'll have to write WCV after writing WOR. >>> >>> >>> In talking with our hardware engineers, using WCV to program the timeout >>> period is not a valid operation. This is why I keep arguing against the >>> pre-timeout feature, and I don't agree that servers should always use >>> pre-timeout. >>> >> >> Not sure if "not valid" is correct - after all, it is mentioned in the >> specification. However, it is at the very least fragile. > > I think we should focus on SBSA spec, but not a specific chip design, > because this is SBSA watchdog, not a driver for an IP core from a > specific chip vendor. > this operation is mentioned in the spec, > and I have tested my driver on Foundation model(from ARM) and a real hardware. > >> >> I tend to agree that we should just forget about pretimeout and >> use your original approach, where the timeout value is used >> to program WOR. Everything else is really just asking for trouble. Another weakness of only using WOR is the timeout limited by this 32bit register. 10s @400MHz generic Timer I don't think this limit is good for a server, once the server is in a heavy load > > I don't mind if we give up pretimeout, The reason I use pretimeout is: > this concept matches the function of two stage timeouts. > > but, If we give up pretimeout, could you give me a suggestion: > > How to config the two stage timeouts > (1)from enabling watchdog to WS0 > (2)the time from WS1 to WS0 > > If we only have one timeout parameter, How to config the two stage timeouts? > Any suggestion ? > > If we make the first stage timeout is timeout/2, this violates the > definition of timeout. > I don't think users expect interrupt, panic or reboot at timeout/2. > > And WS1 definitely isn't a backup of WS0. > >> >> Guenter >> > > > > -- > Best regards, > > Fu Wei > Software Engineer > Red Hat Software (Beijing) Co.,Ltd.Shanghai Branch > Ph: +86 21 61221326(direct) > Ph: +86 186 2020 4684 (mobile) > Room 1512, Regus One Corporate Avenue,Level 15, > One Corporate Avenue,222 Hubin Road,Huangpu District, > Shanghai,China 200021
On 10 June 2015 at 22:22, Timur Tabi <timur@codeaurora.org> wrote: > Fu Wei wrote: >> >> Another weakness of only using WOR is the timeout limited by this >> 32bit register. >> 10s @400MHz generic Timer >> >> I don't think this limit is good for a server, once the server is in a >> heavy load > > > Perhaps, but if that's the limitation of the hardware, then so be it. it is not the real limitation, if we use WCV, SBSA spec has mentioned that. ------ SBSA 2.3-------Page 23 ---------- Note: the watchdog offset register is 32 bits wide. This gives a maximum watch period of around 10s at a system counter frequency of 400MHz. If a larger watch period is required then the compare value can be programmed directly into the compare value register ------ SBSA 2.3-------Page 23 ---------- if some hardware doesn't support writing WCV, that means this hardware is non-standard SBSA watchdog. > > -- > Sent by an employee of the Qualcomm Innovation Center, Inc. > The Qualcomm Innovation Center, Inc. is a member of the > Code Aurora Forum, hosted by The Linux Foundation.
On 10 June 2015 at 22:36, Fu Wei <fu.wei@linaro.org> wrote: > On 10 June 2015 at 22:22, Timur Tabi <timur@codeaurora.org> wrote: >> Fu Wei wrote: >>> >>> Another weakness of only using WOR is the timeout limited by this >>> 32bit register. >>> 10s @400MHz generic Timer >>> >>> I don't think this limit is good for a server, once the server is in a >>> heavy load >> >> >> Perhaps, but if that's the limitation of the hardware, then so be it. > > it is not the real limitation, if we use WCV, SBSA spec has mentioned that. > > ------ SBSA 2.3-------Page 23 ---------- > Note: the watchdog offset register is 32 bits wide. This gives a > maximum watch period of around 10s at a system > counter frequency of 400MHz. If a larger watch period is required then > the compare value can be programmed > directly into the compare value register > ------ SBSA 2.3-------Page 23 ---------- ------ SBSA 2.3-------Page 24 ---------- 0x010 – 0x013 WCV[31:0] 0x014 – 0x017 WCV[63:32] Watchdog compare value. *Read/Write* registers containing the current value in the watchdog compare register. ------ SBSA 2.3-------Page 24 ---------- > > if some hardware doesn't support writing WCV, > that means this hardware is non-standard SBSA watchdog. > >> >> -- >> Sent by an employee of the Qualcomm Innovation Center, Inc. >> The Qualcomm Innovation Center, Inc. is a member of the >> Code Aurora Forum, hosted by The Linux Foundation. > > > > -- > Best regards, > > Fu Wei > Software Engineer > Red Hat Software (Beijing) Co.,Ltd.Shanghai Branch > Ph: +86 21 61221326(direct) > Ph: +86 186 2020 4684 (mobile) > Room 1512, Regus One Corporate Avenue,Level 15, > One Corporate Avenue,222 Hubin Road,Huangpu District, > Shanghai,China 200021
Hi Guenter, On 10 June 2015 at 11:41, Fu Wei <fu.wei@linaro.org> wrote: > Hi Guenter, > > On 10 June 2015 at 00:45, Guenter Roeck <linux@roeck-us.net> wrote: >> On 06/09/2015 09:29 AM, Timur Tabi wrote: >>> >>> On 06/09/2015 11:22 AM, Guenter Roeck wrote: >>>> >>>> >>>> >>>> but I see your point. Essentially, the specification is broken >>>> for all practical purposes, since, as you point out, enabling >>>> the watchdog overwrites and explicitly sets WCV. Effectively >>>> this means that just using WCV to program the timeout period >>>> is not really possible. >>>> >>>> I am not really sure how to address this. We can either only use WOR, >>>> and forget about pretimeout, or we can enforce a minimum pretimeout. >>>> In the latter case, we'll have to write WCV after writing WOR. >>> >>> >>> In talking with our hardware engineers, using WCV to program the timeout >>> period is not a valid operation. This is why I keep arguing against the >>> pre-timeout feature, and I don't agree that servers should always use >>> pre-timeout. >>> >> >> Not sure if "not valid" is correct - after all, it is mentioned in the >> specification. However, it is at the very least fragile. > > I think we should focus on SBSA spec, but not a specific chip design, > because this is SBSA watchdog, not a driver for an IP core from a > specific chip vendor. > this operation is mentioned in the spec, > and I have tested my driver on Foundation model(from ARM) and a real hardware. > >> >> I tend to agree that we should just forget about pretimeout and >> use your original approach, where the timeout value is used >> to program WOR. Everything else is really just asking for trouble. > > I don't mind if we give up pretimeout, The reason I use pretimeout is: > this concept matches the function of two stage timeouts. > > but, If we give up pretimeout, could you give me a suggestion: > > How to config the two stage timeouts > (1)from enabling watchdog to WS0 > (2)the time from WS1 to WS0 > > If we only have one timeout parameter, How to config the two stage timeouts? > Any suggestion ? I have another thought for this, please allow me to sent anther patchset in a day. see if you like it. > > If we make the first stage timeout is timeout/2, this violates the > definition of timeout. > I don't think users expect interrupt, panic or reboot at timeout/2. > > And WS1 definitely isn't a backup of WS0. > >> >> Guenter >> > > > > -- > Best regards, > > Fu Wei > Software Engineer > Red Hat Software (Beijing) Co.,Ltd.Shanghai Branch > Ph: +86 21 61221326(direct) > Ph: +86 186 2020 4684 (mobile) > Room 1512, Regus One Corporate Avenue,Level 15, > One Corporate Avenue,222 Hubin Road,Huangpu District, > Shanghai,China 200021
Hi Guenter, On 10 June 2015 at 23:38, Fu Wei <fu.wei@linaro.org> wrote: > Hi Guenter, > > > On 10 June 2015 at 11:41, Fu Wei <fu.wei@linaro.org> wrote: >> Hi Guenter, >> >> On 10 June 2015 at 00:45, Guenter Roeck <linux@roeck-us.net> wrote: >>> On 06/09/2015 09:29 AM, Timur Tabi wrote: >>>> >>>> On 06/09/2015 11:22 AM, Guenter Roeck wrote: >>>>> >>>>> >>>>> >>>>> but I see your point. Essentially, the specification is broken >>>>> for all practical purposes, since, as you point out, enabling >>>>> the watchdog overwrites and explicitly sets WCV. Effectively >>>>> this means that just using WCV to program the timeout period >>>>> is not really possible. >>>>> >>>>> I am not really sure how to address this. We can either only use WOR, >>>>> and forget about pretimeout, or we can enforce a minimum pretimeout. >>>>> In the latter case, we'll have to write WCV after writing WOR. >>>> >>>> >>>> In talking with our hardware engineers, using WCV to program the timeout >>>> period is not a valid operation. This is why I keep arguing against the >>>> pre-timeout feature, and I don't agree that servers should always use >>>> pre-timeout. >>>> >>> >>> Not sure if "not valid" is correct - after all, it is mentioned in the >>> specification. However, it is at the very least fragile. >> >> I think we should focus on SBSA spec, but not a specific chip design, >> because this is SBSA watchdog, not a driver for an IP core from a >> specific chip vendor. >> this operation is mentioned in the spec, >> and I have tested my driver on Foundation model(from ARM) and a real hardware. >> >>> >>> I tend to agree that we should just forget about pretimeout and >>> use your original approach, where the timeout value is used >>> to program WOR. Everything else is really just asking for trouble. >> >> I don't mind if we give up pretimeout, The reason I use pretimeout is: >> this concept matches the function of two stage timeouts. >> >> but, If we give up pretimeout, could you give me a suggestion: >> >> How to config the two stage timeouts >> (1)from enabling watchdog to WS0 >> (2)the time from WS1 to WS0 >> >> If we only have one timeout parameter, How to config the two stage timeouts? >> Any suggestion ? > > I have another thought for this, please allow me to sent anther > patchset in a day. see if you like it. I have sent a non-pretimeout version patchset, please let me know if you like the non-pretimeout version more. Great thanks for your time. :-) > >> >> If we make the first stage timeout is timeout/2, this violates the >> definition of timeout. >> I don't think users expect interrupt, panic or reboot at timeout/2. >> >> And WS1 definitely isn't a backup of WS0. >> >>> >>> Guenter >>> >> >> >> >> -- >> Best regards, >> >> Fu Wei >> Software Engineer >> Red Hat Software (Beijing) Co.,Ltd.Shanghai Branch >> Ph: +86 21 61221326(direct) >> Ph: +86 186 2020 4684 (mobile) >> Room 1512, Regus One Corporate Avenue,Level 15, >> One Corporate Avenue,222 Hubin Road,Huangpu District, >> Shanghai,China 200021 > > > > -- > Best regards, > > Fu Wei > Software Engineer > Red Hat Software (Beijing) Co.,Ltd.Shanghai Branch > Ph: +86 21 61221326(direct) > Ph: +86 186 2020 4684 (mobile) > Room 1512, Regus One Corporate Avenue,Level 15, > One Corporate Avenue,222 Hubin Road,Huangpu District, > Shanghai,China 200021
On 11 June 2015 at 08:22, Timur Tabi <timur@codeaurora.org> wrote: > Fu Wei wrote: >> >> If we make the first stage timeout is timeout/2, this violates the >> definition of timeout. > > > The documentation says that the hardware needs to reset after the timeout > expires. yes , you are absolutely on this. Great thanks for point out this. my patch is doing this way: trigger WS1 at the timeout expires Before that, using pretimeout for WS0 as an warning. > If you program the hardware to timeout/2, the driver can ignore > WS0 and allow WS1 to reset the hardware. That conforms to the > documentation. yes, technically we can do nothing in WS0, and just wait for WS1. So SBSA watchdog become a one stage timeout watchdog, right? So if user want the WS0 warning, How to make driver know that, and do something in WS0 routine? I think by this way, two stage timeouts, WS0 "alert" will be meaningless. Could you suggest a good way to use WS0, so we can follow SBSA spec? > > -- > Sent by an employee of the Qualcomm Innovation Center, Inc. > The Qualcomm Innovation Center, Inc. is a member of the > Code Aurora Forum, hosted by The Linux Foundation.
On 11 June 2015 at 11:45, Timur Tabi <timur@codeaurora.org> wrote: > Fu Wei wrote: >> >> Could you suggest a good way to use WS0, so we can follow SBSA spec? > > > To avoid the timeout/2 problem, WS0 calls panic, which is the "real" > timeout/reset. WS1 is then a "backup" that is ignored by the driver. That > is, the driver doesn't do anything with WS1 and it doesn't tell the kernel > about WS1. could you suggestion : (1) how to config the time from WS0 to WS1 without touching timeout. (2) if we don't config the time from WS0 to WS1, what is the better time for ALL server and ALL situation > > I know you don't like the idea of WS1 as a backup timeout, but this is one > way to solve the problem. It is not "I don't like" WS1 is not a backup in SBSA spec. Page 21 ： "The initial signal is typically wired to an interrupt and alerts the system. " If this is the backup, it should say "reset the system" > > > -- > Sent by an employee of the Qualcomm Innovation Center, Inc. > The Qualcomm Innovation Center, Inc. is a member of the > Code Aurora Forum, hosted by The Linux Foundation.
Hi Guenter On 11 June 2015 at 13:13, Guenter Roeck <linux@roeck-us.net> wrote: > On 06/10/2015 08:45 PM, Timur Tabi wrote: >> >> Fu Wei wrote: >>> >>> Could you suggest a good way to use WS0, so we can follow SBSA spec? >> >> >> To avoid the timeout/2 problem, WS0 calls panic, which is the "real" >> timeout/reset. WS1 is then a "backup" that is ignored by the driver. That >> is, the driver doesn't do anything with WS1 and it doesn't tell the kernel >> about WS1. >> >> I know you don't like the idea of WS1 as a backup timeout, but this is one >> way to solve the problem. >> > This is what I would do. If so, Please check the non-pretimeout version. Thanks > > Guenter >
On 06/03/2015 02:53 PM, Timur Tabi wrote: > On 06/03/2015 01:25 PM, Guenter Roeck wrote: >> In general the idea here would be to use a crashdump kernel, which, >> when loaded, would reset the watchdog before it fires. This kernel >> would then write a core dump to a specified location. > > What is the mechanism for resetting the watchdog? The only code that > knows about the hardware registers is this driver. Does the crashdump > kernel call the watchdog stop function? > >> If arm64 doesn't support a crashdump kernel, it might still be possible >> to log the backtrace somewhere (eg in nvram using pstore if that is >> supported via acpi or efi). Just to go back and explicitly answer this, arm64 does have support for crashdump, using the standard kexec/kdump approach, exactly as on x86. There's still some more work to be done to get the ACPI case fully upstream (e.g. on X-Gene platforms such as the HP ProLiant Moonshot m400 we need non-PSCI CPU parking protocol offlining when booting in UEFI/ACPI mode), but it's what we are doing in RHEL(SA) and the goal is to help clean up the remaining pieces upstream there. Jon. -- To unsubscribe from this list: send the line "unsubscribe devicetree" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 10/09/2015:06:45:17 PM, Jon Masters wrote: > On 06/03/2015 02:53 PM, Timur Tabi wrote: > > On 06/03/2015 01:25 PM, Guenter Roeck wrote: > >> In general the idea here would be to use a crashdump kernel, which, > >> when loaded, would reset the watchdog before it fires. This kernel > >> would then write a core dump to a specified location. And this is what we do in fedora or RHEL. There had been some work ongoing in fedora [1][2] which will help to reset any active watchdog in kdump kernel(if the watchdog driver has been registered to watchdog_class). It will eventually help a watchdog on ARM64 platform as well. [1] https://lists.fedoraproject.org/pipermail/kexec/2015-September/002295.html [2] https://github.com/pratyushanand/kexec-tools/commits/watchdog_fmaster ~Pratyush -- To unsubscribe from this list: send the line "unsubscribe devicetree" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Sep 10, 2015 at 06:45:17PM -0400, Jon Masters wrote: > On 06/03/2015 02:53 PM, Timur Tabi wrote: > > On 06/03/2015 01:25 PM, Guenter Roeck wrote: > >> In general the idea here would be to use a crashdump kernel, which, > >> when loaded, would reset the watchdog before it fires. This kernel > >> would then write a core dump to a specified location. > > > > What is the mechanism for resetting the watchdog? The only code that > > knows about the hardware registers is this driver. Does the crashdump > > kernel call the watchdog stop function? > > > >> If arm64 doesn't support a crashdump kernel, it might still be possible > >> to log the backtrace somewhere (eg in nvram using pstore if that is > >> supported via acpi or efi). > > Just to go back and explicitly answer this, arm64 does have support for > crashdump, using the standard kexec/kdump approach, exactly as on x86. Just a clarification - this is not (yet) supported in mainline, not even with DT.
Hi Pratyush, Great thanks for your help on some update for watchdog framework. For " Fix parent of watchdog_devices", I will update my patchset. For the upstreaming patchset"Sysfs status read support", will make a patch. But upstream it when your patchset is merged. On 14 September 2015 at 12:21, Pratyush Anand <panand@redhat.com> wrote: > On 10/09/2015:06:45:17 PM, Jon Masters wrote: >> On 06/03/2015 02:53 PM, Timur Tabi wrote: >> > On 06/03/2015 01:25 PM, Guenter Roeck wrote: >> >> In general the idea here would be to use a crashdump kernel, which, >> >> when loaded, would reset the watchdog before it fires. This kernel >> >> would then write a core dump to a specified location. > > And this is what we do in fedora or RHEL. There had been some work ongoing in > fedora [1][2] which will help to reset any active watchdog in kdump kernel(if > the watchdog driver has been registered to watchdog_class). It will eventually > help a watchdog on ARM64 platform as well. > > [1] https://lists.fedoraproject.org/pipermail/kexec/2015-September/002295.html > [2] https://github.com/pratyushanand/kexec-tools/commits/watchdog_fmaster > > ~Pratyush
Hi Jon, On 11 September 2015 at 06:45, Jon Masters <jcm@redhat.com> wrote: > On 06/03/2015 02:53 PM, Timur Tabi wrote: >> On 06/03/2015 01:25 PM, Guenter Roeck wrote: >>> In general the idea here would be to use a crashdump kernel, which, >>> when loaded, would reset the watchdog before it fires. This kernel >>> would then write a core dump to a specified location. >> >> What is the mechanism for resetting the watchdog? The only code that >> knows about the hardware registers is this driver. Does the crashdump >> kernel call the watchdog stop function? >> >>> If arm64 doesn't support a crashdump kernel, it might still be possible >>> to log the backtrace somewhere (eg in nvram using pstore if that is >>> supported via acpi or efi). > > Just to go back and explicitly answer this, arm64 does have support for > crashdump, using the standard kexec/kdump approach, exactly as on x86. > There's still some more work to be done to get the ACPI case fully > upstream (e.g. on X-Gene platforms such as the HP ProLiant Moonshot m400 > we need non-PSCI CPU parking protocol offlining when booting in > UEFI/ACPI mode), but it's what we are doing in RHEL(SA) and the goal is > to help clean up the remaining pieces upstream there. Great thanks for your info. I have tried kexec/kdump on a real aarch64 hardware, that works well. Although it's still under development and upstreaming, the support is there. After discussing with some kexec/kdump developer, I think this driver can cooperate with kexec/kdump. > > Jon. >
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig index e5e7c55..20f9980 100644 --- a/drivers/watchdog/Kconfig +++ b/drivers/watchdog/Kconfig @@ -152,6 +152,18 @@ config ARM_SP805_WATCHDOG ARM Primecell SP805 Watchdog timer. This will reboot your system when the timeout is reached. +config ARM_SBSA_WATCHDOG + tristate "ARM SBSA Generic Watchdog" + depends on ARM64 + depends on ARM_ARCH_TIMER + select WATCHDOG_CORE + select ACPI_GTDT if ACPI + help + ARM SBSA Generic Watchdog. This watchdog has two Watchdog timeouts. + The first timeout will trigger a panic; the second timeout will + trigger a system reset. + More details: ARM DEN0029B - Server Base System Architecture (SBSA) + config AT91RM9200_WATCHDOG tristate "AT91RM9200 watchdog" depends on SOC_AT91RM9200 && MFD_SYSCON diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile index 5c19294..471f1b7c 100644 --- a/drivers/watchdog/Makefile +++ b/drivers/watchdog/Makefile @@ -30,6 +30,7 @@ obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o # ARM Architecture obj-$(CONFIG_ARM_SP805_WATCHDOG) += sp805_wdt.o +obj-$(CONFIG_ARM_SBSA_WATCHDOG) += sbsa_gwdt.o obj-$(CONFIG_AT91RM9200_WATCHDOG) += at91rm9200_wdt.o obj-$(CONFIG_AT91SAM9X_WATCHDOG) += at91sam9_wdt.o obj-$(CONFIG_CADENCE_WATCHDOG) += cadence_wdt.o diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c new file mode 100644 index 0000000..76b6763 --- /dev/null +++ b/drivers/watchdog/sbsa_gwdt.c @@ -0,0 +1,426 @@ +/* + * SBSA(Server Base System Architecture) Generic Watchdog driver + * + * Copyright (c) 2015, Linaro Ltd. + * Author: Fu Wei <fu.wei@linaro.org> + * Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License 2 as published + * by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * Note: This SBSA Generic watchdog driver is compatible with + * the pretimeout concept of Linux kernel. + * The timeout and pretimeout are set by the different REGs. + * The first watch period is set by writing WCV directly, + * that can support more than 10s timeout at the maximum + * system counter frequency. + * The second watch period is set by WOR(32bit) which will be loaded + * automatically by hardware, when WS0 is triggered. + * This gives a maximum watch period of around 10s at the maximum + * system counter frequency. + * The System Counter shall run at maximum of 400MHz. + * More details: ARM DEN0029B - Server Base System Architecture (SBSA) + * + * Kernel/API: P---------| pretimeout + * |-------------------------------T timeout + * SBSA GWDT: P--WOR---WS1 pretimeout + * |-------WCV----------WS0~~~~~~~~T timeout + */ + +#include <linux/io.h> +#include <linux/interrupt.h> +#include <linux/module.h> +#include <linux/moduleparam.h> +#include <linux/of.h> +#include <linux/of_device.h> +#include <linux/platform_device.h> +#include <linux/uaccess.h> +#include <linux/watchdog.h> +#include <asm/arch_timer.h> + +/* SBSA Generic Watchdog register definitions */ +/* refresh frame */ +#define SBSA_GWDT_WRR 0x000 + +/* control frame */ +#define SBSA_GWDT_WCS 0x000 +#define SBSA_GWDT_WOR 0x008 +#define SBSA_GWDT_WCV_LO 0x010 +#define SBSA_GWDT_WCV_HI 0x014 + +/* refresh/control frame */ +#define SBSA_GWDT_W_IIDR 0xfcc +#define SBSA_GWDT_IDR 0xfd0 + +/* Watchdog Control and Status Register */ +#define SBSA_GWDT_WCS_EN BIT(0) +#define SBSA_GWDT_WCS_WS0 BIT(1) +#define SBSA_GWDT_WCS_WS1 BIT(2) + +/** + * struct sbsa_gwdt - Internal representation of the SBSA GWDT + * @wdd: kernel watchdog_device structure + * @clk: store the System Counter clock frequency, in Hz. + * @refresh_base: Virtual address of the watchdog refresh frame + * @control_base: Virtual address of the watchdog control frame + */ +struct sbsa_gwdt { + struct watchdog_device wdd; + u32 clk; + void __iomem *refresh_base; + void __iomem *control_base; +}; + +#define to_sbsa_gwdt(e) container_of(e, struct sbsa_gwdt, wdd) + +#define DEFAULT_TIMEOUT 30 /* seconds, the 1st + 2nd watch periods*/ +#define DEFAULT_PRETIMEOUT 10 /* seconds, the 2nd watch period*/ + +static unsigned int timeout; +module_param(timeout, uint, 0); +MODULE_PARM_DESC(timeout, + "Watchdog timeout in seconds. (>=0, default=" + __MODULE_STRING(DEFAULT_TIMEOUT) ")"); + +static unsigned int pretimeout; +module_param(pretimeout, uint, 0); +MODULE_PARM_DESC(pretimeout, + "Watchdog pretimeout in seconds. (>=0, default=" + __MODULE_STRING(DEFAULT_PRETIMEOUT) ")"); + +static bool nowayout = WATCHDOG_NOWAYOUT; +module_param(nowayout, bool, S_IRUGO); +MODULE_PARM_DESC(nowayout, + "Watchdog cannot be stopped once started (default=" + __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); + +/* + * help functions for accessing 32bit registers of SBSA Generic Watchdog + */ +static void sbsa_gwdt_cf_write(unsigned int reg, u32 val, + struct watchdog_device *wdd) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + + writel_relaxed(val, gwdt->control_base + reg); +} + +static void sbsa_gwdt_rf_write(unsigned int reg, u32 val, + struct watchdog_device *wdd) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + + writel_relaxed(val, gwdt->refresh_base + reg); +} + +static u32 sbsa_gwdt_cf_read(unsigned int reg, struct watchdog_device *wdd) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + + return readl_relaxed(gwdt->control_base + reg); +} + +/* + * help functions for accessing 64bit WCV register + */ +static u64 sbsa_gwdt_get_wcv(struct watchdog_device *wdd) +{ + u32 wcv_lo, wcv_hi; + + do { + wcv_hi = sbsa_gwdt_cf_read(SBSA_GWDT_WCV_HI, wdd); + wcv_lo = sbsa_gwdt_cf_read(SBSA_GWDT_WCV_LO, wdd); + } while (wcv_hi != sbsa_gwdt_cf_read(SBSA_GWDT_WCV_HI, wdd)); + + return (((u64)wcv_hi << 32) | wcv_lo); +} + +static void sbsa_gwdt_set_wcv(struct watchdog_device *wdd, u64 value) +{ + sbsa_gwdt_cf_write(SBSA_GWDT_WCV_HI, upper_32_bits(value), wdd); + sbsa_gwdt_cf_write(SBSA_GWDT_WCV_LO, lower_32_bits(value), wdd); +} + +static void reload_timeout_to_wcv(struct watchdog_device *wdd) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + u64 wcv; + + wcv = arch_counter_get_cntvct() + + (u64)(wdd->timeout - wdd->pretimeout) * gwdt->clk; + + sbsa_gwdt_set_wcv(wdd, wcv); +} + +static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd, + unsigned int timeout) +{ + wdd->timeout = timeout; + + return 0; +} + +static int sbsa_gwdt_set_pretimeout(struct watchdog_device *wdd, + unsigned int pretimeout) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + u32 wor; + + wdd->pretimeout = pretimeout; + + if (!pretimeout) + /* + * If pretimeout is 0, it gives driver a timeslot(1s) + * to update WCV after an explicit refresh(sbsa_gwdt_start) + */ + wor = gwdt->clk; + else + wor = pretimeout * gwdt->clk; + + /* refresh the WOR, that will cause an explicit watchdog refresh */ + sbsa_gwdt_cf_write(SBSA_GWDT_WOR, wor, wdd); + + return 0; +} + +static unsigned int sbsa_gwdt_get_timeleft(struct watchdog_device *wdd) +{ + struct sbsa_gwdt *gwdt = to_sbsa_gwdt(wdd); + u64 timeleft = sbsa_gwdt_get_wcv(wdd) - arch_counter_get_cntvct(); + + do_div(timeleft, gwdt->clk); + + return timeleft; +} + +static int sbsa_gwdt_keepalive(struct watchdog_device *wdd) +{ + reload_timeout_to_wcv(wdd); + + return 0; +} + +static int sbsa_gwdt_start(struct watchdog_device *wdd) +{ + /* + * Writing WRR for an explicit watchdog refresh. + * You can write anyting(like 0xc0ffee). + * Force refresh due to hardware bug found in certain Soc. + */ + sbsa_gwdt_rf_write(SBSA_GWDT_WRR, 0xc0ffee, wdd); + /* writing WCS will cause an explicit watchdog refresh */ + sbsa_gwdt_cf_write(SBSA_GWDT_WCS, SBSA_GWDT_WCS_EN, wdd); + + return sbsa_gwdt_keepalive(wdd); +} + +static int sbsa_gwdt_stop(struct watchdog_device *wdd) +{ + sbsa_gwdt_cf_write(SBSA_GWDT_WCS, 0, wdd); + + return 0; +} + +static irqreturn_t sbsa_gwdt_interrupt(int irq, void *dev_id) +{ + struct sbsa_gwdt *gwdt = (struct sbsa_gwdt *)dev_id; + struct watchdog_device *wdd = &gwdt->wdd; + + if (wdd->pretimeout) + /* The pretimeout is valid, go panic */ + panic("SBSA Watchdog pre-timeout"); + else + /* We don't use pretimeout, trigger WS1 now*/ + sbsa_gwdt_set_wcv(wdd, 0); + + return IRQ_HANDLED; +} + +static struct watchdog_info sbsa_gwdt_info = { + .identity = "SBSA Generic Watchdog", + .options = WDIOF_SETTIMEOUT | + WDIOF_KEEPALIVEPING | + WDIOF_MAGICCLOSE | + WDIOF_PRETIMEOUT | + WDIOF_CARDRESET, +}; + +static struct watchdog_ops sbsa_gwdt_ops = { + .owner = THIS_MODULE, + .start = sbsa_gwdt_start, + .stop = sbsa_gwdt_stop, + .ping = sbsa_gwdt_keepalive, + .set_timeout = sbsa_gwdt_set_timeout, + .set_pretimeout = sbsa_gwdt_set_pretimeout, + .get_timeleft = sbsa_gwdt_get_timeleft, +}; + +static int sbsa_gwdt_probe(struct platform_device *pdev) +{ + u64 first_period_max = U64_MAX; + struct device *dev = &pdev->dev; + struct watchdog_device *wdd; + struct sbsa_gwdt *gwdt; + struct resource *res; + void *rf_base, *cf_base; + int ret, irq; + u32 status; + + gwdt = devm_kzalloc(dev, sizeof(*gwdt), GFP_KERNEL); + if (!gwdt) + return -ENOMEM; + platform_set_drvdata(pdev, gwdt); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "refresh"); + rf_base = devm_ioremap_resource(dev, res); + if (IS_ERR(rf_base)) + return PTR_ERR(rf_base); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "control"); + cf_base = devm_ioremap_resource(dev, res); + if (IS_ERR(cf_base)) + return PTR_ERR(cf_base); + + irq = platform_get_irq_byname(pdev, "ws0"); + if (irq < 0) { + dev_err(dev, "unable to get ws0 interrupt.\n"); + return irq; + } + + /* + * Get the frequency of system counter from the cp15 interface of ARM + * Generic timer. We don't need to check it, because if it returns "0", + * system would panic in very early stage. + */ + gwdt->clk = arch_timer_get_cntfrq(); + gwdt->refresh_base = rf_base; + gwdt->control_base = cf_base; + + wdd = &gwdt->wdd; + wdd->parent = dev; + wdd->info = &sbsa_gwdt_info; + wdd->ops = &sbsa_gwdt_ops; + watchdog_set_drvdata(wdd, gwdt); + watchdog_set_nowayout(wdd, nowayout); + + wdd->min_pretimeout = 0; + wdd->max_pretimeout = U32_MAX / gwdt->clk; + wdd->min_timeout = 1; + do_div(first_period_max, gwdt->clk); + wdd->max_timeout = first_period_max; + + wdd->pretimeout = DEFAULT_PRETIMEOUT; + wdd->timeout = DEFAULT_TIMEOUT; + watchdog_init_timeouts(wdd, pretimeout, timeout, dev); + + status = sbsa_gwdt_cf_read(SBSA_GWDT_WCS, wdd); + if (status & SBSA_GWDT_WCS_WS1) { + dev_warn(dev, "System reset by WDT(WCV: %llx)\n", + sbsa_gwdt_get_wcv(wdd)); + wdd->bootstatus |= WDIOF_CARDRESET; + } + /* Check if watchdog is already enabled */ + if (status & SBSA_GWDT_WCS_EN) { + dev_warn(dev, "already enabled!\n"); + sbsa_gwdt_keepalive(wdd); + } + + /* update pretimeout to WOR */ + sbsa_gwdt_set_pretimeout(wdd, wdd->pretimeout); + + ret = devm_request_irq(dev, irq, sbsa_gwdt_interrupt, 0, + pdev->name, gwdt); + if (ret) { + dev_err(dev, "unable to request IRQ %d\n", irq); + return ret; + } + + ret = watchdog_register_device(wdd); + if (ret) + return ret; + + dev_info(dev, "Initialized with %ds timeout, %ds pretimeout @ %u Hz\n", + wdd->timeout, wdd->pretimeout, gwdt->clk); + + return 0; +} + +static void sbsa_gwdt_shutdown(struct platform_device *pdev) +{ + struct sbsa_gwdt *gwdt = platform_get_drvdata(pdev); + + sbsa_gwdt_stop(&gwdt->wdd); +} + +static int sbsa_gwdt_remove(struct platform_device *pdev) +{ + struct sbsa_gwdt *gwdt = platform_get_drvdata(pdev); + + watchdog_unregister_device(&gwdt->wdd); + + return 0; +} + +/* Disable watchdog if it is active during suspend */ +static int __maybe_unused sbsa_gwdt_suspend(struct device *dev) +{ + struct sbsa_gwdt *gwdt = dev_get_drvdata(dev); + + if (watchdog_active(&gwdt->wdd)) + sbsa_gwdt_stop(&gwdt->wdd); + + return 0; +} + +/* Enable watchdog and configure it if necessary */ +static int __maybe_unused sbsa_gwdt_resume(struct device *dev) +{ + struct sbsa_gwdt *gwdt = dev_get_drvdata(dev); + + if (watchdog_active(&gwdt->wdd)) + sbsa_gwdt_start(&gwdt->wdd); + + return 0; +} + +static const struct dev_pm_ops sbsa_gwdt_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(sbsa_gwdt_suspend, sbsa_gwdt_resume) +}; + +static const struct of_device_id sbsa_gwdt_of_match[] = { + { .compatible = "arm,sbsa-gwdt", }, + {}, +}; +MODULE_DEVICE_TABLE(of, sbsa_gwdt_of_match); + +static const struct platform_device_id sbsa_gwdt_pdev_match[] = { + { .name = "sbsa-gwdt", }, + {}, +}; +MODULE_DEVICE_TABLE(platform, sbsa_gwdt_pdev_match); + +static struct platform_driver sbsa_gwdt_driver = { + .driver = { + .name = "sbsa-gwdt", + .pm = &sbsa_gwdt_pm_ops, + .of_match_table = sbsa_gwdt_of_match, + }, + .probe = sbsa_gwdt_probe, + .remove = sbsa_gwdt_remove, + .shutdown = sbsa_gwdt_shutdown, + .id_table = sbsa_gwdt_pdev_match, +}; + +module_platform_driver(sbsa_gwdt_driver); + +MODULE_DESCRIPTION("SBSA Generic Watchdog Driver"); +MODULE_VERSION("v1.0"); +MODULE_AUTHOR("Fu Wei <fu.wei@linaro.org>"); +MODULE_AUTHOR("Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>"); +MODULE_LICENSE("GPL v2");