On 6/15/24 08:51, L.Q wrote:
Step 1:
Call imx2_wdt_set_timeout with a timeout value greater than 128
This illegal value will be stored in wdog->timeout
This is not an illegal value because the driver sets max_hw_heartbeat_ms
which lets the watchdog core handle timeout values exceeding the maximum
timeout supported by the chip.
[ ... ]
static inline void imx2_wdt_setup(struct watchdog_device *wdog)
{
struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog);
u32 val;
regmap_read(wdev->regmap, IMX2_WDT_WCR, &val);
/* Suspend timer in low power mode, write once-only */
val |= IMX2_WDT_WCR_WDZST;
/* Strip the old watchdog Time-Out value */
val &= ~IMX2_WDT_WCR_WT;
/* Generate internal chip-level reset if WDOG times out */
if (!wdev->ext_reset)
val &= ~IMX2_WDT_WCR_WRE;
/* Or if external-reset assert WDOG_B reset only on time-out */
else
val |= IMX2_WDT_WCR_WRE;
/* Keep Watchdog Disabled */
val &= ~IMX2_WDT_WCR_WDE;
/* Set the watchdog's Time-Out value */
val |= WDOG_SEC_TO_COUNT(wdog->timeout);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
That is the bug. It needs to be
val |= WDOG_SEC_TO_COUNT(min(wdog->timeout, IMX2_WDT_MAX_TIME));
Guenter
