watchdog-kernel-api.rst 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350
  1. ===============================================
  2. The Linux WatchDog Timer Driver Core kernel API
  3. ===============================================
  4. Last reviewed: 12-Feb-2013
  5. Wim Van Sebroeck <wim@iguana.be>
  6. Introduction
  7. ------------
  8. This document does not describe what a WatchDog Timer (WDT) Driver or Device is.
  9. It also does not describe the API which can be used by user space to communicate
  10. with a WatchDog Timer. If you want to know this then please read the following
  11. file: Documentation/watchdog/watchdog-api.rst .
  12. So what does this document describe? It describes the API that can be used by
  13. WatchDog Timer Drivers that want to use the WatchDog Timer Driver Core
  14. Framework. This framework provides all interfacing towards user space so that
  15. the same code does not have to be reproduced each time. This also means that
  16. a watchdog timer driver then only needs to provide the different routines
  17. (operations) that control the watchdog timer (WDT).
  18. The API
  19. -------
  20. Each watchdog timer driver that wants to use the WatchDog Timer Driver Core
  21. must #include <linux/watchdog.h> (you would have to do this anyway when
  22. writing a watchdog device driver). This include file contains following
  23. register/unregister routines::
  24. extern int watchdog_register_device(struct watchdog_device *);
  25. extern void watchdog_unregister_device(struct watchdog_device *);
  26. The watchdog_register_device routine registers a watchdog timer device.
  27. The parameter of this routine is a pointer to a watchdog_device structure.
  28. This routine returns zero on success and a negative errno code for failure.
  29. The watchdog_unregister_device routine deregisters a registered watchdog timer
  30. device. The parameter of this routine is the pointer to the registered
  31. watchdog_device structure.
  32. The watchdog subsystem includes an registration deferral mechanism,
  33. which allows you to register an watchdog as early as you wish during
  34. the boot process.
  35. The watchdog device structure looks like this::
  36. struct watchdog_device {
  37. int id;
  38. struct device *parent;
  39. const struct attribute_group **groups;
  40. const struct watchdog_info *info;
  41. const struct watchdog_ops *ops;
  42. const struct watchdog_governor *gov;
  43. unsigned int bootstatus;
  44. unsigned int timeout;
  45. unsigned int pretimeout;
  46. unsigned int min_timeout;
  47. unsigned int max_timeout;
  48. unsigned int min_hw_heartbeat_ms;
  49. unsigned int max_hw_heartbeat_ms;
  50. struct notifier_block reboot_nb;
  51. struct notifier_block restart_nb;
  52. void *driver_data;
  53. struct watchdog_core_data *wd_data;
  54. unsigned long status;
  55. struct list_head deferred;
  56. };
  57. It contains following fields:
  58. * id: set by watchdog_register_device, id 0 is special. It has both a
  59. /dev/watchdog0 cdev (dynamic major, minor 0) as well as the old
  60. /dev/watchdog miscdev. The id is set automatically when calling
  61. watchdog_register_device.
  62. * parent: set this to the parent device (or NULL) before calling
  63. watchdog_register_device.
  64. * groups: List of sysfs attribute groups to create when creating the watchdog
  65. device.
  66. * info: a pointer to a watchdog_info structure. This structure gives some
  67. additional information about the watchdog timer itself. (Like it's unique name)
  68. * ops: a pointer to the list of watchdog operations that the watchdog supports.
  69. * gov: a pointer to the assigned watchdog device pretimeout governor or NULL.
  70. * timeout: the watchdog timer's timeout value (in seconds).
  71. This is the time after which the system will reboot if user space does
  72. not send a heartbeat request if WDOG_ACTIVE is set.
  73. * pretimeout: the watchdog timer's pretimeout value (in seconds).
  74. * min_timeout: the watchdog timer's minimum timeout value (in seconds).
  75. If set, the minimum configurable value for 'timeout'.
  76. * max_timeout: the watchdog timer's maximum timeout value (in seconds),
  77. as seen from userspace. If set, the maximum configurable value for
  78. 'timeout'. Not used if max_hw_heartbeat_ms is non-zero.
  79. * min_hw_heartbeat_ms: Hardware limit for minimum time between heartbeats,
  80. in milli-seconds. This value is normally 0; it should only be provided
  81. if the hardware can not tolerate lower intervals between heartbeats.
  82. * max_hw_heartbeat_ms: Maximum hardware heartbeat, in milli-seconds.
  83. If set, the infrastructure will send heartbeats to the watchdog driver
  84. if 'timeout' is larger than max_hw_heartbeat_ms, unless WDOG_ACTIVE
  85. is set and userspace failed to send a heartbeat for at least 'timeout'
  86. seconds. max_hw_heartbeat_ms must be set if a driver does not implement
  87. the stop function.
  88. * reboot_nb: notifier block that is registered for reboot notifications, for
  89. internal use only. If the driver calls watchdog_stop_on_reboot, watchdog core
  90. will stop the watchdog on such notifications.
  91. * restart_nb: notifier block that is registered for machine restart, for
  92. internal use only. If a watchdog is capable of restarting the machine, it
  93. should define ops->restart. Priority can be changed through
  94. watchdog_set_restart_priority.
  95. * bootstatus: status of the device after booting (reported with watchdog
  96. WDIOF_* status bits).
  97. * driver_data: a pointer to the drivers private data of a watchdog device.
  98. This data should only be accessed via the watchdog_set_drvdata and
  99. watchdog_get_drvdata routines.
  100. * wd_data: a pointer to watchdog core internal data.
  101. * status: this field contains a number of status bits that give extra
  102. information about the status of the device (Like: is the watchdog timer
  103. running/active, or is the nowayout bit set).
  104. * deferred: entry in wtd_deferred_reg_list which is used to
  105. register early initialized watchdogs.
  106. The list of watchdog operations is defined as::
  107. struct watchdog_ops {
  108. struct module *owner;
  109. /* mandatory operations */
  110. int (*start)(struct watchdog_device *);
  111. /* optional operations */
  112. int (*stop)(struct watchdog_device *);
  113. int (*ping)(struct watchdog_device *);
  114. unsigned int (*status)(struct watchdog_device *);
  115. int (*set_timeout)(struct watchdog_device *, unsigned int);
  116. int (*set_pretimeout)(struct watchdog_device *, unsigned int);
  117. unsigned int (*get_timeleft)(struct watchdog_device *);
  118. int (*restart)(struct watchdog_device *);
  119. long (*ioctl)(struct watchdog_device *, unsigned int, unsigned long);
  120. };
  121. It is important that you first define the module owner of the watchdog timer
  122. driver's operations. This module owner will be used to lock the module when
  123. the watchdog is active. (This to avoid a system crash when you unload the
  124. module and /dev/watchdog is still open).
  125. Some operations are mandatory and some are optional. The mandatory operations
  126. are:
  127. * start: this is a pointer to the routine that starts the watchdog timer
  128. device.
  129. The routine needs a pointer to the watchdog timer device structure as a
  130. parameter. It returns zero on success or a negative errno code for failure.
  131. Not all watchdog timer hardware supports the same functionality. That's why
  132. all other routines/operations are optional. They only need to be provided if
  133. they are supported. These optional routines/operations are:
  134. * stop: with this routine the watchdog timer device is being stopped.
  135. The routine needs a pointer to the watchdog timer device structure as a
  136. parameter. It returns zero on success or a negative errno code for failure.
  137. Some watchdog timer hardware can only be started and not be stopped. A
  138. driver supporting such hardware does not have to implement the stop routine.
  139. If a driver has no stop function, the watchdog core will set WDOG_HW_RUNNING
  140. and start calling the driver's keepalive pings function after the watchdog
  141. device is closed.
  142. If a watchdog driver does not implement the stop function, it must set
  143. max_hw_heartbeat_ms.
  144. * ping: this is the routine that sends a keepalive ping to the watchdog timer
  145. hardware.
  146. The routine needs a pointer to the watchdog timer device structure as a
  147. parameter. It returns zero on success or a negative errno code for failure.
  148. Most hardware that does not support this as a separate function uses the
  149. start function to restart the watchdog timer hardware. And that's also what
  150. the watchdog timer driver core does: to send a keepalive ping to the watchdog
  151. timer hardware it will either use the ping operation (when available) or the
  152. start operation (when the ping operation is not available).
  153. (Note: the WDIOC_KEEPALIVE ioctl call will only be active when the
  154. WDIOF_KEEPALIVEPING bit has been set in the option field on the watchdog's
  155. info structure).
  156. * status: this routine checks the status of the watchdog timer device. The
  157. status of the device is reported with watchdog WDIOF_* status flags/bits.
  158. WDIOF_MAGICCLOSE and WDIOF_KEEPALIVEPING are reported by the watchdog core;
  159. it is not necessary to report those bits from the driver. Also, if no status
  160. function is provided by the driver, the watchdog core reports the status bits
  161. provided in the bootstatus variable of struct watchdog_device.
  162. * set_timeout: this routine checks and changes the timeout of the watchdog
  163. timer device. It returns 0 on success, -EINVAL for "parameter out of range"
  164. and -EIO for "could not write value to the watchdog". On success this
  165. routine should set the timeout value of the watchdog_device to the
  166. achieved timeout value (which may be different from the requested one
  167. because the watchdog does not necessarily have a 1 second resolution).
  168. Drivers implementing max_hw_heartbeat_ms set the hardware watchdog heartbeat
  169. to the minimum of timeout and max_hw_heartbeat_ms. Those drivers set the
  170. timeout value of the watchdog_device either to the requested timeout value
  171. (if it is larger than max_hw_heartbeat_ms), or to the achieved timeout value.
  172. (Note: the WDIOF_SETTIMEOUT needs to be set in the options field of the
  173. watchdog's info structure).
  174. If the watchdog driver does not have to perform any action but setting the
  175. watchdog_device.timeout, this callback can be omitted.
  176. If set_timeout is not provided but, WDIOF_SETTIMEOUT is set, the watchdog
  177. infrastructure updates the timeout value of the watchdog_device internally
  178. to the requested value.
  179. If the pretimeout feature is used (WDIOF_PRETIMEOUT), then set_timeout must
  180. also take care of checking if pretimeout is still valid and set up the timer
  181. accordingly. This can't be done in the core without races, so it is the
  182. duty of the driver.
  183. * set_pretimeout: this routine checks and changes the pretimeout value of
  184. the watchdog. It is optional because not all watchdogs support pretimeout
  185. notification. The timeout value is not an absolute time, but the number of
  186. seconds before the actual timeout would happen. It returns 0 on success,
  187. -EINVAL for "parameter out of range" and -EIO for "could not write value to
  188. the watchdog". A value of 0 disables pretimeout notification.
  189. (Note: the WDIOF_PRETIMEOUT needs to be set in the options field of the
  190. watchdog's info structure).
  191. If the watchdog driver does not have to perform any action but setting the
  192. watchdog_device.pretimeout, this callback can be omitted. That means if
  193. set_pretimeout is not provided but WDIOF_PRETIMEOUT is set, the watchdog
  194. infrastructure updates the pretimeout value of the watchdog_device internally
  195. to the requested value.
  196. * get_timeleft: this routines returns the time that's left before a reset.
  197. * restart: this routine restarts the machine. It returns 0 on success or a
  198. negative errno code for failure.
  199. * ioctl: if this routine is present then it will be called first before we do
  200. our own internal ioctl call handling. This routine should return -ENOIOCTLCMD
  201. if a command is not supported. The parameters that are passed to the ioctl
  202. call are: watchdog_device, cmd and arg.
  203. The status bits should (preferably) be set with the set_bit and clear_bit alike
  204. bit-operations. The status bits that are defined are:
  205. * WDOG_ACTIVE: this status bit indicates whether or not a watchdog timer device
  206. is active or not from user perspective. User space is expected to send
  207. heartbeat requests to the driver while this flag is set.
  208. * WDOG_NO_WAY_OUT: this bit stores the nowayout setting for the watchdog.
  209. If this bit is set then the watchdog timer will not be able to stop.
  210. * WDOG_HW_RUNNING: Set by the watchdog driver if the hardware watchdog is
  211. running. The bit must be set if the watchdog timer hardware can not be
  212. stopped. The bit may also be set if the watchdog timer is running after
  213. booting, before the watchdog device is opened. If set, the watchdog
  214. infrastructure will send keepalives to the watchdog hardware while
  215. WDOG_ACTIVE is not set.
  216. Note: when you register the watchdog timer device with this bit set,
  217. then opening /dev/watchdog will skip the start operation but send a keepalive
  218. request instead.
  219. To set the WDOG_NO_WAY_OUT status bit (before registering your watchdog
  220. timer device) you can either:
  221. * set it statically in your watchdog_device struct with
  222. .status = WATCHDOG_NOWAYOUT_INIT_STATUS,
  223. (this will set the value the same as CONFIG_WATCHDOG_NOWAYOUT) or
  224. * use the following helper function::
  225. static inline void watchdog_set_nowayout(struct watchdog_device *wdd,
  226. int nowayout)
  227. Note:
  228. The WatchDog Timer Driver Core supports the magic close feature and
  229. the nowayout feature. To use the magic close feature you must set the
  230. WDIOF_MAGICCLOSE bit in the options field of the watchdog's info structure.
  231. The nowayout feature will overrule the magic close feature.
  232. To get or set driver specific data the following two helper functions should be
  233. used::
  234. static inline void watchdog_set_drvdata(struct watchdog_device *wdd,
  235. void *data)
  236. static inline void *watchdog_get_drvdata(struct watchdog_device *wdd)
  237. The watchdog_set_drvdata function allows you to add driver specific data. The
  238. arguments of this function are the watchdog device where you want to add the
  239. driver specific data to and a pointer to the data itself.
  240. The watchdog_get_drvdata function allows you to retrieve driver specific data.
  241. The argument of this function is the watchdog device where you want to retrieve
  242. data from. The function returns the pointer to the driver specific data.
  243. To initialize the timeout field, the following function can be used::
  244. extern int watchdog_init_timeout(struct watchdog_device *wdd,
  245. unsigned int timeout_parm,
  246. struct device *dev);
  247. The watchdog_init_timeout function allows you to initialize the timeout field
  248. using the module timeout parameter or by retrieving the timeout-sec property from
  249. the device tree (if the module timeout parameter is invalid). Best practice is
  250. to set the default timeout value as timeout value in the watchdog_device and
  251. then use this function to set the user "preferred" timeout value.
  252. This routine returns zero on success and a negative errno code for failure.
  253. To disable the watchdog on reboot, the user must call the following helper::
  254. static inline void watchdog_stop_on_reboot(struct watchdog_device *wdd);
  255. To disable the watchdog when unregistering the watchdog, the user must call
  256. the following helper. Note that this will only stop the watchdog if the
  257. nowayout flag is not set.
  258. ::
  259. static inline void watchdog_stop_on_unregister(struct watchdog_device *wdd);
  260. To change the priority of the restart handler the following helper should be
  261. used::
  262. void watchdog_set_restart_priority(struct watchdog_device *wdd, int priority);
  263. User should follow the following guidelines for setting the priority:
  264. * 0: should be called in last resort, has limited restart capabilities
  265. * 128: default restart handler, use if no other handler is expected to be
  266. available, and/or if restart is sufficient to restart the entire system
  267. * 255: highest priority, will preempt all other restart handlers
  268. To raise a pretimeout notification, the following function should be used::
  269. void watchdog_notify_pretimeout(struct watchdog_device *wdd)
  270. The function can be called in the interrupt context. If watchdog pretimeout
  271. governor framework (kbuild CONFIG_WATCHDOG_PRETIMEOUT_GOV symbol) is enabled,
  272. an action is taken by a preconfigured pretimeout governor preassigned to
  273. the watchdog device. If watchdog pretimeout governor framework is not
  274. enabled, watchdog_notify_pretimeout() prints a notification message to
  275. the kernel log buffer.
  276. To set the last known HW keepalive time for a watchdog, the following function
  277. should be used::
  278. int watchdog_set_last_hw_keepalive(struct watchdog_device *wdd,
  279. unsigned int last_ping_ms)
  280. This function must be called immediately after watchdog registration. It
  281. sets the last known hardware heartbeat to have happened last_ping_ms before
  282. current time. Calling this is only needed if the watchdog is already running
  283. when probe is called, and the watchdog can only be pinged after the
  284. min_hw_heartbeat_ms time has passed from the last ping.