【分析笔记】全志平台 gpio_wdt 驱动应用和 stack crash 解决
使用说明
第一次遇到看门狗芯片是通过切换电平信号来喂狗，如 SGM706 芯片，之前也比较少会用到看门狗芯片。原本打算参考 sunxi-wdt.c 的框架，利用定时器自己写一个，无意中发现内核已经有 gpio_wdt.c 驱动程序，其原理也是通过内核定时器实现喂狗。因其使用了 of_get_gpio_flags() 接口获取 GPIO 信息，和 gpio-keys.c 驱动一样，该接口存在内存越界的问题，需要略作修改才能使用。
内核配置
内核版本：Linux 4.9
make ARCH=arm64 menuconfig
Device Drivers --->
[*] Watchdog Timer Support --->
<*> LED Support for GPIO connected LEDs
<*> Watchdog device controlled through GPIO-line
配置文件
sys_config.fex
全志平台便捷方式配置，也可以使用通用的 dts 配置方式
;----------------------------------------------------------------------------------
;gpio-wdt parameters
;compatible: 匹配平台驱动
;hw_algo: 清除看门狗计数方式：切换方式(toggle)或脉冲方式(level)
;hw_margin_ms: 看门狗电路会触发复位的最长时间(毫秒)，不能小于 2 或者大于 65535
;always-running: 如果看门狗不能关闭，使能后驱动默认会自动喂狗，在应用层调用 STOP 接口不会执行关闭
;gpios: 连接看门狗芯片 WDI 的引脚
;----------------------------------------------------------------------------------
[wdt-gpio]
compatible = "linux,wdt-gpio"
hw_algo = "level"
hw_margin_ms = 1600
always-running = "true"
gpios = port:PL12<1><default><default><default>
配置选项说明：linux-4.9\Documentation\devicetree\bindings\watchdog\gpio_wdt.txt
* GPIO-controlled Watchdog
Required Properties:
- compatible: Should contain "linux,wdt-gpio".
- gpios: From common gpio binding; gpio connection to WDT reset pin.
- hw_algo: The algorithm used by the driver. Should be one of the
following values:
- toggle: Either a high-to-low or a low-to-high transition clears
the WDT counter. The watchdog timer is disabled when GPIO is
left floating or connected to a three-state buffer.
- level: Low or high level starts counting WDT timeout,
the opposite level disables the WDT. Active level is determined
by the GPIO flags.
- hw_margin_ms: Maximum time to reset watchdog circuit (milliseconds).
Optional Properties:
- always-running: If the watchdog timer cannot be disabled, add this flag to
have the driver keep toggling the signal without a client. It will only cease
to toggle the signal when the device is open and the timeout elapsed.
Example:
watchdog: watchdog {
/* ADM706 */
compatible = "linux,wdt-gpio";
gpios = <&gpio3 9 GPIO_ACTIVE_LOW>;
hw_algo = "toggle";
hw_margin_ms = <1600>;
};
内存越界
日志信息
[ 3.727333] sunxi-wdt 1c20ca0.watchdog: Watchdog enabled (timeout=16 sec, nowayout=0)
[ 3.736874] of_get_named_gpiod_flags: parsed 'gpios' property of node '/soc@01c00000/wdt-gpio[0]' - status (0)
[ 3.748392] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffff8008655044
[ 3.748392]
[ 3.760564] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.9.56 #179
[ 3.767382] Hardware name: sun50iw1 (DT)
[ 3.771771] Call trace:
[ 3.774522] [<ffffff800808a7d4>] dump_backtrace+0x0/0x22c
[ 3.780566] [<ffffff800808aa24>] show_stack+0x24/0x30
[ 3.786226] [<ffffff80083c9a64>] dump_stack+0x8c/0xb0
[ 3.791880] [<ffffff80081a5960>] panic+0x14c/0x298
[ 3.797247] [<ffffff80080a19d0>] print_tainted+0x0/0xa8
[ 3.803099] [<ffffff8008655044>] gpio_wdt_probe+0x230/0x258
[ 3.809338] [<ffffff80084b3e9c>] platform_drv_probe+0x60/0xac
[ 3.815770] [<ffffff80084b1a6c>] driver_probe_device+0x1b8/0x3d4
[ 3.822493] [<ffffff80084b1d1c>] __driver_attach+0x94/0x108
[ 3.828729] [<ffffff80084af68c>] bus_for_each_dev+0x88/0xc8
[ 3.834964] [<ffffff80084b1374>] driver_attach+0x30/0x3c
[ 3.840908] [<ffffff80084b0d24>] bus_add_driver+0xf8/0x24c
[ 3.847046] [<ffffff80084b2a74>] driver_register+0x9c/0xe8
[ 3.853186] [<ffffff80084b3de0>] __platform_driver_register+0x5c/0x68
[ 3.860400] [<ffffff8008d48a20>] gpio_wdt_driver_init+0x18/0x20
[ 3.867026] [<ffffff8008083a2c>] do_one_initcall+0xb0/0x14c
[ 3.873267] [<ffffff8008d10d64>] kernel_init_freeable+0x14c/0x1e8
[ 3.880093] [<ffffff8008970724>] kernel_init+0x18/0x104
[ 3.885941] [<ffffff8008083050>] ret_from_fork+0x10/0x40
[ 3.891884] SMP: stopping secondary CPUs
[ 3.896276] Kernel Offset: disabled
[ 3.900178] Memory Limit: none
[ 3.909173] Rebooting in 5 seconds..
解决补丁
--- linux-4.9\drivers\watchdog\gpio_wdt.c 2022-09-13 17:51:57.000000000 +0800
+++ linux-4.9\drivers\watchdog\gpio_wdt.c 2022-09-13 17:51:37.000000000 +0800
@@ -12,12 +12,13 @@
#include <linux/err.h>
#include <linux/delay.h>
#include <linux/module.h>
#include <linux/of_gpio.h>
#include <linux/platform_device.h>
#include <linux/watchdog.h>
+#include <linux/sunxi-gpio.h>
#define SOFT_TIMEOUT_MIN 1
#define SOFT_TIMEOUT_DEF 60
#define SOFT_TIMEOUT_MAX 0xffff
enum {
@@ -138,29 +139,29 @@
.set_timeout = gpio_wdt_set_timeout,
};
static int gpio_wdt_probe(struct platform_device *pdev)
{
struct gpio_wdt_priv *priv;
- enum of_gpio_flags flags;
+ struct gpio_config gpio_flags;
unsigned int hw_margin;
unsigned long f = 0;
const char *algo;
int ret;
priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
platform_set_drvdata(pdev, priv);
- priv->gpio = of_get_gpio_flags(pdev->dev.of_node, 0, &flags);
+ priv->gpio = of_get_gpio_flags(pdev->dev.of_node, 0, (enum of_gpio_flags *)&gpio_flags);
if (!gpio_is_valid(priv->gpio))
return priv->gpio;
- priv->active_low = flags & OF_GPIO_ACTIVE_LOW;
+ priv->active_low = gpio_flags.data & OF_GPIO_ACTIVE_LOW;
ret = of_property_read_string(pdev->dev.of_node, "hw_algo", &algo);
if (ret)
return ret;
if (!strcmp(algo, "toggle")) {
priv->hw_algo = HW_ALGO_TOGGLE;
原因分析
- gpio_wdt 驱动使用 of_get_gpio_flags() 获取 dts 里面 gpio 配置信息。
- 但是 of_get_gpio_flags() 传入 enum of_gpio_flags 类型来获取配置信息。
- of_get_gpio_flags() 的最终实现由具体的 SOC 厂商实现，这里是全志厂商实现。
- 实现的函数为：drivers/pinctrl/sunxi/pinctrl-sunxi.c --> sunxi_pinctrl_gpio_of_xlate()。
- 在 sunxi_pinctrl_gpio_of_xlate() 却是通过强制转换 struct gpio_config 类型存储 gpio 配置信息。
- enum of_gpio_flags 占用 4 字节，而 struct gpio_config 占用 20 字节，出现内存越界操作的问题。
// include/linux/of_gpio.h
enum of_gpio_flags {
OF_GPIO_ACTIVE_LOW = 0x1,
OF_GPIO_SINGLE_ENDED = 0x2,
}; // 4Byte
// include/linux/sunxi-gpio.h
struct gpio_config {
u32 gpio;
u32 mul_sel;
u32 pull;
u32 drv_level;
u32 data;
}; // 20Byte
// drivers/pinctrl/sunxi/pinctrl-sunxi.c
static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
const struct of_phandle_args *gpiospec,
u32 *flags)
{
struct gpio_config *config;
int pin, base;
base = PINS_PER_BANK * gpiospec->args[0];
pin = base + gpiospec->args[1];
pin = pin - gc->base;
if (pin > gc->ngpio)
return -EINVAL;
if (flags) {
// 问题出在这个条件下面的赋值语句
// 传进来的是 enum of_gpio_flags，只有 4Byte
// 结果使用的 struct gpio_config，却有 20Byte
config = (struct gpio_config *)flags;
config->gpio = base + gpiospec->args[1];
config->mul_sel = gpiospec->args[2];
config->drv_level = gpiospec->args[3];
config->pull = gpiospec->args[4];
config->data = gpiospec->args[5];
}
return pin;
}
