[PATCH] watchdog: sbsa-gwdt: clamp timeout before updating wdd->timeout

[PATCH] watchdog: sbsa-gwdt: clamp timeout before updating wdd->timeout

[Zhu Ling]

sbsa_gwdt_set_timeout() updates wdd->timeout before clamping the user
requested value to the hardware-supported range. As a result,
WDIOC_GETTIMEOUT and sysfs may report a timeout larger than what is
actually programmed into the hardware.

Clamp the timeout first and then update wdd->timeout so that
userspace-visible values always reflect the effective hardware
timeout.

Signed-off-by: Zhu Ling <1536943441@qq.com>
---
 drivers/watchdog/sbsa_gwdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
index 6ce1bfb39..826469645 100644
--- a/drivers/watchdog/sbsa_gwdt.c
+++ b/drivers/watchdog/sbsa_gwdt.c
@@ -155,8 +155,8 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd,
 {
 	struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd);
 
-	wdd->timeout = timeout;
 	timeout = clamp_t(unsigned int, timeout, 1, wdd->max_hw_heartbeat_ms / 1000);
+	wdd->timeout = timeout;
 
 	if (action)
 		sbsa_gwdt_reg_write((u64)gwdt->clk * timeout, gwdt);
-- 
2.34.1

Re: [PATCH] watchdog: sbsa-gwdt: clamp timeout before updating wdd->timeout

[Guenter Roeck]

On 12/17/25 18:31, Zhu Ling wrote:
> sbsa_gwdt_set_timeout() updates wdd->timeout before clamping the user
> requested value to the hardware-supported range. As a result,
> WDIOC_GETTIMEOUT and sysfs may report a timeout larger than what is
> actually programmed into the hardware.
> 
> Clamp the timeout first and then update wdd->timeout so that
> userspace-visible values always reflect the effective hardware
> timeout.
> 
> Signed-off-by: Zhu Ling <1536943441@qq.com>
> ---
>   drivers/watchdog/sbsa_gwdt.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
> index 6ce1bfb39..826469645 100644
> --- a/drivers/watchdog/sbsa_gwdt.c
> +++ b/drivers/watchdog/sbsa_gwdt.c
> @@ -155,8 +155,8 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd,
>   {
>   	struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd);
>   
> -	wdd->timeout = timeout;
>   	timeout = clamp_t(unsigned int, timeout, 1, wdd->max_hw_heartbeat_ms / 1000);
> +	wdd->timeout = timeout;
>   
>   	if (action)
>   		sbsa_gwdt_reg_write((u64)gwdt->clk * timeout, gwdt);


This is wrong. With max_hw_heartbeat_ms set, the timeout value is not limited to
the hardware timeout and becomes a virtual timeout. If it is larger than the
maximum hardware timeout, the watchdog core will issue any necessary heartbeats.
The current code is perfectly correct.

NACK.

Guenter

Re: 回复： [PATCH] watchdog: sbsa-gwdt: clamp timeout before updating wdd->timeout

[Guenter Roeck]

On 12/19/25 01:46, 1536943441 wrote:
> Hi Guenter,
> 
> thank you for the detailed explanation.
> 
> I misunderstood the watchdog core semantics here. With max_hw_heartbeat_ms set, the userspace timeout can represent a virtual timeout and is not expected to be limited by the single hardware timeout. Given that, my change is indeed wrong
> and I will drop this patch.
> 
> One follow-up question: in my testing, "/sys/class/watchdog/watchdog0/max_timeout" always shows 0 for sbsa-gwdt.  Should the driver set wdd->max_timeout in probe(), or is a 0 value expected when max_hw_heartbeat_ms/virtual timeouts are used?
> 

The value is as expected, and the driver should not do anything. A value of 0
means "unlimited", which in practice means that the limit is UINT_MAX / 1000.

Turns out the attribute is not documented. We should add it to the ABI
documentation. If/when I find the time ...

Thanks,
Guenter