Re: [PATCH v3 02/13] watchdog: stm32_iwdg: detect whether the watchdog is running

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] watchdog: stm32_iwdg: unconfigured timeout in
  stm32_iwdg_probe()
- [Medium] watchdog: stm32_iwdg: WDOG_HW_RUNNING gated on Kconfig in
  stm32_iwdg_probe()
--

commit 7c2acc17f93336becc29a7a139de848c3db25624
Author: Clément Le Goffic <clement.legoffic@foss.st.com>

watchdog: stm32_iwdg: detect whether the watchdog is running

This commit adds stm32_iwdg_is_running() to detect whether the watchdog
was already started by an earlier boot stage and sets WDOG_HW_RUNNING in
stm32_iwdg_probe() only when it is running.

[Severity: High]
In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(), does
removing the call to stm32_iwdg_start(wdd) leave the hardware prescaler
(IWDG_PR), reload value (IWDG_RLR), and early-wakeup interrupt
(IWDG_EWCR) registers out of sync with wdd->timeout and wdd->pretimeout?

When stm32_iwdg_is_running(wdt) returns true, stm32_iwdg_probe() now sets
WDOG_HW_RUNNING without programming wdd->timeout into the hardware or
reading the bootloader's configured timeout back into wdd->timeout.
Because stm32_iwdg_ops provides stm32_iwdg_ping() (line 162), which only
writes KR_KEY_RELOAD to IWDG_KR, the watchdog core's keepalive worker
schedules pings at half of wdd->timeout while reloading the bootloader's
counter value. If the bootloader configured a hardware timeout shorter
than wdd->timeout / 2, the watchdog expires and resets the system before
the next keepalive ping. Even after userspace opens /dev/watchdog,
watchdog_start() in drivers/watchdog/watchdog_dev.c (line 261) sees both
WDOG_HW_RUNNING and wdd->ops->ping set and calls __watchdog_ping(wdd)
instead of wdd->ops->start(wdd), leaving IWDG_PR, IWDG_RLR, and IWDG_EWCR
unconfigured.

[Severity: Medium]
In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(),
should setting WDOG_HW_RUNNING be unconditional when
stm32_iwdg_is_running(wdt) is true, rather than gated on
IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED)?

In drivers/watchdog/watchdog_dev.c at line 1099 in
watchdog_cdev_register(), the watchdog core checks watchdog_hw_running()
to pin the module and device references and to evaluate the runtime
watchdog.handle_boot_enabled parameter. Gating the check on
IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED) in the driver prevents
the core from knowing the hardware is active when
CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=n, breaking the
watchdog.handle_boot_enabled=1 kernel command-line override and skipping
the module/device reference pinning.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=2