talos-op-linux/drivers/watchdog, branch master

Merge tag 'linux-watchdog-5.6-rc1' of git://www.linux-watchdog.org/linux-watchdog

2020-02-07T20:30:16+00:00

Pull watchdog updates from Wim Van Sebroeck: - add IT8786 chipset ID - addition of sam9x60 compatible watchdog - da9062 improvements - fix UAF in reboot notifier handling in watchdog core code - other fixes and small improvements * tag 'linux-watchdog-5.6-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog: da9062: make restart handler atomic safe watchdog: mtk_wdt: mt2712: Add reset controller watchdog: mtk_wdt: mt8183: Add reset controller dt-bindings: mediatek: mt2712: Add #reset-cells dt-bindings: mediatek: mt8183: Add #reset-cells dt-bindings: watchdog: da9062: add suspend disable option watchdog: it87_wdt: add IT8786 ID watchdog: dw_wdt: ping watchdog to reset countdown before start watchdog: fix UAF in reboot notifier handling in watchdog core code watchdog: cadence: Skip printing pointer value watchdog: qcom: Use platform_get_irq_optional() for bark irq watchdog: da9062: add power management ops watchdog: make DesignWare watchdog allow users to set bigger timeout value drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe watchdog: sama5d4_wdt: addition of sam9x60 compatible watchdog

Merge tag 'ioremap-5.6' of git://git.infradead.org/users/hch/ioremap

2020-01-27T21:03:00+00:00

Pull ioremap updates from Christoph Hellwig: "Remove the ioremap_nocache API (plus wrappers) that are always identical to ioremap" * tag 'ioremap-5.6' of git://git.infradead.org/users/hch/ioremap: remove ioremap_nocache and devm_ioremap_nocache MIPS: define ioremap_nocache to ioremap

watchdog: da9062: make restart handler atomic safe

2020-01-27T14:55:49+00:00

The restart handler is executed during the shutdown phase which is atomic/irq-less. The i2c framework supports atomic transfers since commit 63b96983a5dd ("i2c: core: introduce callbacks for atomic transfers") to address this use case. Using regmap within an atomic context is allowed only if the regmap type is MMIO and the cache type 'flat' or no cache is used. Using the i2c_smbus_write_byte_data() function can be done without additional tests because: 1) the DA9062 is an i2c-only device and 2) the i2c framework emulates the smbus protocol if the host adapter does not support smbus_xfer by using the master_xfer. Signed-off-by: Marco Felsch Reviewed-by: Guenter Roeck Reviewed-by: Stefan Lengfeld Tested-by: Stefan Lengfeld Reviewed-by: Adam Thomson Link: https://lore.kernel.org/r/20200115162307.7336-1-m.felsch@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: mtk_wdt: mt2712: Add reset controller

2020-01-27T14:55:49+00:00

Add reset controller for 2712. Besides watchdog, MTK toprgu module alsa provide sub-system (eg, audio, camera, codec and connectivity) software reset functionality. Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Acked-by: Matthias Brugger Link: https://lore.kernel.org/r/20200115085828.27791-5-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: mtk_wdt: mt8183: Add reset controller

2020-01-27T14:55:48+00:00

Add reset controller API in watchdog driver. Besides watchdog, MTK toprgu module alsa provide sub-system (eg, audio, camera, codec and connectivity) software reset functionality. Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Reviewed-by: Guenter Roeck Acked-by: Matthias Brugger Link: https://lore.kernel.org/r/20200115085828.27791-4-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: it87_wdt: add IT8786 ID

2020-01-27T14:55:47+00:00

IT8786 watchdog works as in IT872x Tested on VECOW ECS-9000 board. Signed-off-by: Vincent Prince Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200123140544.25937-1-vincent.prince.fr@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: dw_wdt: ping watchdog to reset countdown before start

2020-01-27T14:55:46+00:00

Currently on an rk3288 SoC when trying to use the watchdog the SoC will instantly reset. This is due to the watchdog countdown counter being set to its initial value of 0x0. Reset the watchdog counter before start in order to correctly start the countdown timer from the right position. Signed-off-by: Jack Mitchell Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200107155155.278521-1-ml@embed.me.uk Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: fix UAF in reboot notifier handling in watchdog core code

2020-01-27T14:55:46+00:00

After the commit 44ea39420fc9 ("drivers/watchdog: make use of devm_register_reboot_notifier()") the struct notifier_block reboot_nb in the struct watchdog_device is removed from the reboot notifiers chain at the time watchdog's chardev is closed. But at least in i6300esb.c case reboot_nb is embedded in the struct esb_dev which can be freed on its device removal and before the chardev is closed, thus UAF at reboot: [ 7.728581] esb_probe: esb_dev.watchdog_device ffff91316f91ab28 ts# uname -r note the address ^^^ 5.5.0-rc5-ae6088-wdog ts# ./openwdog0 & [1] 696 ts# opened /dev/watchdog0, sleeping 10s... ts# echo 1 > /sys/devices/pci0000\:00/0000\:00\:09.0/remove [ 178.086079] devres:rel_nodes: dev ffff91317668a0b0 data ffff91316f91ab28 esb_dev.watchdog_device.reboot_nb memory is freed here ^^^ ts# ...woken up [ 181.459010] devres:rel_nodes: dev ffff913171781000 data ffff913174a1dae8 [ 181.460195] devm_unreg_reboot_notifier: res ffff913174a1dae8 nb ffff91316f91ab78 attempt to use memory already freed ^^^ [ 181.461063] devm_unreg_reboot_notifier: nb->call 6b6b6b6b6b6b6b6b [ 181.461243] devm_unreg_reboot_notifier: nb->next 6b6b6b6b6b6b6b6b freed memory is filled with a slub poison ^^^ [1]+ Done ./openwdog0 ts# reboot [ 229.921862] systemd-shutdown[1]: Rebooting. [ 229.939265] notifier_call_chain: nb ffffffff9c6c2f20 nb->next ffffffff9c6d50c0 [ 229.943080] notifier_call_chain: nb ffffffff9c6d50c0 nb->next 6b6b6b6b6b6b6b6b [ 229.946054] notifier_call_chain: nb 6b6b6b6b6b6b6b6b INVAL [ 229.957584] general protection fault: 0000 [#1] SMP [ 229.958770] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.5.0-rc5-ae6088-wdog [ 229.960224] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... [ 229.963288] RIP: 0010:notifier_call_chain+0x66/0xd0 [ 229.969082] RSP: 0018:ffffb20dc0013d88 EFLAGS: 00010246 [ 229.970812] RAX: 000000000000002e RBX: 6b6b6b6b6b6b6b6b RCX: 00000000000008b3 [ 229.972929] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffffffff9ccc46ac [ 229.975028] RBP: 0000000000000001 R08: 0000000000000000 R09: 00000000000008b3 [ 229.977039] R10: 0000000000000001 R11: ffffffff9c26c740 R12: 0000000000000000 [ 229.979155] R13: 6b6b6b6b6b6b6b6b R14: 0000000000000000 R15: 00000000fffffffa ... slub_debug=FZP poison ^^^ [ 229.989089] Call Trace: [ 229.990157] blocking_notifier_call_chain+0x43/0x59 [ 229.991401] kernel_restart_prepare+0x14/0x30 [ 229.992607] kernel_restart+0x9/0x30 [ 229.993800] __do_sys_reboot+0x1d2/0x210 [ 230.000149] do_syscall_64+0x3d/0x130 [ 230.001277] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 230.002639] RIP: 0033:0x7f5461bdd177 [ 230.016402] Modules linked in: i6300esb [ 230.050261] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix the crash by reverting 44ea39420fc9 so unregister_reboot_notifier() is called when watchdog device is removed. This also makes handling of the reboot notifier unified with the handling of the restart handler, which is freed with unregister_restart_handler() in the same place. Fixes: 44ea39420fc9 ("drivers/watchdog: make use of devm_register_reboot_notifier()") Cc: stable@vger.kernel.org # v4.15+ Signed-off-by: Vladis Dronov Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200108125347.6067-1-vdronov@redhat.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: cadence: Skip printing pointer value

2020-01-27T14:55:46+00:00

"%p" is not printing the pointer value. In driver, printing pointer value is not useful so avoiding print. Signed-off-by: Srinivas Neeli Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1576825096-26605-1-git-send-email-srinivas.neeli@xilinx.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck

watchdog: qcom: Use platform_get_irq_optional() for bark irq

2020-01-27T14:55:45+00:00

platform_get_irq() prints an error message when the interrupt is not available. So on platforms where bark interrupt is not specified, following error message is observed on SDM845. [ 2.975888] qcom_wdt 17980000.watchdog: IRQ index 0 not found This is also seen on SC7180, SM8150 SoCs as well. Fix this by using platform_get_irq_optional() instead. Fixes: 36375491a4395654 ("watchdog: qcom: support pre-timeout when the bark irq is available") Signed-off-by: Sai Prakash Ranjan Reviewed-by: Bjorn Andersson Reviewed-by: Guenter Roeck Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20191213064934.4112-1-saiprakash.ranjan@codeaurora.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck