rust: add watchdog abstraction and Rust softdog driver
Subsystems (2)
v2 cover rust: add watchdog abstraction and Rust softdog driver
This series adds Rust abstractions for the watchdog subsystem and a Rust software watchdog driver functionally equivalent to the core of the C softdog.
Patch 1 adds the watchdog abstraction: a Device wrapper, an Info wrapper with option flags, an Options configuration struct, a #[vtable] WatchdogOps trait with an associated Data type for driver private data, and a generic Registration that owns the device, the ops table and the driver data in a single heap allocation.
Patch 2 adds a minimal kernel::reboot module wrapping emergency_restart(), needed by the softdog driver.
Patch 3 adds the softdog_rs driver: an hrtimer is armed on start and re-armed on every keepalive ping; if userspace stops pinging, the timer expires and the system is restarted via emergency_restart().
Changes since v1 [1]:
Most of v2 is a redesign addressing the review feedback from Guenter (via the Sashiko review [2]), Miguel, and the kernel test robot:
- The ops table is no longer a &'static mut supplied by the driver; it is built by the abstraction and embedded in the per-device heap allocation, so multiple device instances need no static mutable state (Sashiko).
- Driver private data is now supported via an associated Data type; every callback receives a reference to it (Sashiko).
- Callbacks now take only shared references and Data must be Sync:
the watchdog core does not hold its lock on every callback path (the first start/ping on open, the reboot notifier stop, and the stop on unregistration run without it), so exclusive references would be unsound.
- max_hw_heartbeat_ms is configurable and the stop()-or-heartbeat registration requirement is documented (Sashiko).
- Removed the Registration::device() accessor that allowed aliasing with the references used in callbacks (Sashiko).
- stop_on_reboot is now opt-in and rejected with EINVAL for drivers without stop(); nowayout defaults to CONFIG_WATCHDOG_NOWAYOUT (Sashiko).
- The watchdog is always stopped on unregistration so no callback can run after the driver data is freed.
- softdog_rs now actually bites: it arms an hrtimer and calls emergency_restart() on expiry, instead of relying on the (wrong) assumption that the core handles expiry (Sashiko).
- Kconfig mutual exclusion fixed to SOFT_WATCHDOG=n; !SOFT_WATCHDOG still allowed both drivers as modules (Sashiko).
- C helpers marked __rust_helper (Miguel), and updated for the const-qualified watchdog_active()/watchdog_hw_running().
- Fixed rustfmt and clippy issues reported by the kernel test robot.
- Drivers no longer use raw bindings: added the Info wrapper, the flags module, and the kernel::reboot module.
- Added the new rust watchdog files to MAINTAINERS.
- Rebased onto current mainline (post-v7.2-rc4).
[1] https://lore.kernel.org/linux-watchdog/[email protected]/
[2] https://sashiko.dev/#/patchset/20260323195138.5541-1-iprintercanon%40gmail.com
Artem Lytkin (3):
rust: watchdog: add watchdog device abstraction
rust: reboot: add emergency_restart() wrapper
watchdog: softdog_rs: add Rust software watchdog driver
MAINTAINERS | 2 + drivers/watchdog/Kconfig | 12 + drivers/watchdog/Makefile | 1 + drivers/watchdog/softdog_rs.rs | 143 +++++++++++ rust/bindings/bindings_helper.h | 2 + rust/helpers/helpers.c | 1 + rust/helpers/watchdog.c | 38 +++ rust/kernel/lib.rs | 3 + rust/kernel/reboot.rs | 19 ++ rust/kernel/watchdog.rs | 522 ++++++++++++++++++++++++++++++++++++++++ 10 files changed, 743 insertions(+) create mode 100644 drivers/watchdog/softdog_rs.rs create mode 100644 rust/helpers/watchdog.c create mode 100644 rust/kernel/reboot.rs create mode 100644 rust/kernel/watchdog.rs
Signature · 1 line
2.43.0
PATCH v2 1/3 rust: watchdog: add watchdog device abstraction
Add Rust abstractions for the Linux watchdog subsystem, enabling watchdog drivers to be written in Rust:
- A Device wrapper around struct watchdog_device providing accessors for timeout, pretimeout, and status fields.
- An Info wrapper around struct watchdog_info with a const constructor, plus option flags in the flags module, so drivers do not need to touch raw bindings.
- An Options struct describing timeouts, max_hw_heartbeat_ms, nowayout (defaulting to CONFIG_WATCHDOG_NOWAYOUT), and stop_on_reboot policy.
- A #[vtable] WatchdogOps trait with an associated Data type for driver private data. start() is mandatory; stop(), ping(), set_timeout(), set_pretimeout(), and get_timeleft() are optional.
- A generic Registration<T> that owns the watchdog_device, the watchdog_ops (with owner set from ThisModule for correct module refcounting), and the driver data in a single heap allocation, so no static mutable state is needed in drivers and multiple device instances are naturally supported.
The watchdog core does not hold its lock on every callback path (the first start/ping on open, the reboot notifier stop, and the stop on unregistration run without it), so callbacks receive only shared references and the driver data must be Sync; mutable driver state needs its own synchronisation.
The watchdog is configured to stop on unregistration so that a stoppable watchdog does not keep running unattended. Requesting stop_on_reboot without a stop() implementation is rejected with EINVAL since the core would only warn and skip the notifier.
Also add C helper functions (marked __rust_helper) for the inline watchdog functions, include linux/watchdog.h in the bindings helper header, and add the new files to the WATCHDOG DEVICE DRIVERS section of MAINTAINERS.
--- MAINTAINERS | 2 + rust/bindings/bindings_helper.h | 1 + rust/helpers/helpers.c | 1 + rust/helpers/watchdog.c | 38 +++ rust/kernel/lib.rs | 2 + rust/kernel/watchdog.rs | 522 ++++++++++++++++++++++++++++++++ 6 files changed, 566 insertions(+) create mode 100644 rust/helpers/watchdog.c create mode 100644 rust/kernel/watchdog.rs
MAINTAINERS +2 -0
@@ -29027,6 +29027,8 @@ F: drivers/watchdog/ F: include/linux/watchdog.h F: include/trace/events/watchdog.h F: include/uapi/linux/watchdog.h +F: rust/helpers/watchdog.c +F: rust/kernel/watchdog.rs WAVE5 VPU CODEC DRIVER M: Nas Chung <[email protected]>
rust/bindings/bindings_helper.h +1 -0
@@ -91,6 +91,7 @@#include <linux/tracepoint.h> #include <linux/usb.h> #include <linux/wait.h> +#include <linux/watchdog.h> #include <linux/workqueue.h> #include <linux/xarray.h> #include <trace/events/rust_sample.h>
rust/helpers/helpers.c +1 -0
@@ -98,5 +98,6 @@#include "usb.c" #include "vmalloc.c" #include "wait.c" +#include "watchdog.c" #include "workqueue.c" #include "xarray.c"
rust/helpers/watchdog.c new file +38 -0
@@ -0,0 +1,38 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/watchdog.h> + +__rust_helper bool rust_helper_watchdog_active(const struct watchdog_device *wdd) +{ +return watchdog_active (wdd); +} + +__rust_helper bool rust_helper_watchdog_hw_running(const struct watchdog_device *wdd) +{ +return watchdog_hw_running (wdd); +} + +__rust_helper void rust_helper_watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout) +{ +watchdog_set_nowayout (wdd, nowayout); +} + +__rust_helper void rust_helper_watchdog_stop_on_reboot(struct watchdog_device *wdd) +{ +watchdog_stop_on_reboot (wdd); +} + +__rust_helper void rust_helper_watchdog_stop_on_unregister(struct watchdog_device *wdd) +{ +watchdog_stop_on_unregister (wdd); +} + +__rust_helper void rust_helper_watchdog_set_drvdata(struct watchdog_device *wdd, void *data) +{ +watchdog_set_drvdata (wdd, data); +} + +__rust_helper void *rust_helper_watchdog_get_drvdata(struct watchdog_device *wdd) +{ +return watchdog_get_drvdata (wdd); +}
rust/kernel/lib.rs +2 -0
@@ -134,6 +134,8 @@pub mod uaccess;#[cfg( CONFIG_USB = "y" )] pub mod usb; +#[cfg( CONFIG_WATCHDOG )] +pub mod watchdog;pub mod workqueue;pub mod xarray;
rust/kernel/watchdog.rs new file +522 -0
522 lines not on this page · raw message
base-commit: 248951ddc14de84de3910f9b13f51491a8cd91df
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH v2 1/3] rust: watchdog: add watchdog device abstraction
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider: - [High] Safe `Device::set_timeout` and `Device::timeout` cause data races (Undefined Behavior). - [High]…
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
- [High] Safe Device::set_timeout and Device::timeout cause data races (Undefined Behavior).
- [High] Missing set_pretimeout method in Device.
- [High] Missing commonly required driver fields (bootstatus and min_hw_heartbeat_ms) in Options.
- [Low] Missing #[inline] annotations on small abstraction methods.
- [Low] Imports do not follow the kernel vertical import style.
--
--- Patch [1]: [PATCH v2 1/3] rust: watchdog: add watchdog device abstraction --- commit a2fbd8297d0a9de19e082cbcf7ecd7a0e4b836b1
Author: Artem Lytkin <[email protected]>
Subject: rust: watchdog: add watchdog device abstraction
This commit adds Rust abstractions for the Linux watchdog subsystem, enabling watchdog drivers to be written in Rust. It introduces wrappers for the watchdog device, identity info, and options, along with a trait for driver operations and a registration mechanism.
rust/kernel/watchdog.rs line 7
Quoted 13 lines
rust/kernel/watchdog.rs new file +7
-0@@ -0,0 +1,522 @@ +// SPDX-License-Identifier: GPL-2.0 + +//! Watchdog device support. +//! +//! C headers: [`include/linux/watchdog.h`](srctree/include/linux/watchdog.h). + +use crate ::{bindings, device, error::*, prelude::*, types::Opaque };
[Severity: Low]
This isn't a bug, but should the imports here follow the kernel vertical import style as documented in the general coding guidelines?
Quoted 2 lines
rust/kernel/watchdog.rs new file +2
-0+use core::marker::PhantomData ; +
[ ... ]
rust/kernel/watchdog.rs line 37
Quoted 8 lines
rust/kernel/watchdog.rs new file +8
-0+impl Device { +/// Creates a new [`Device`] reference from a raw pointer. +/// +/// # Safety +/// +/// - `ptr` must point at a valid `watchdog_device`. +/// - The returned reference must not outlive the callback invocation. +unsafe fn from_raw <'a>(ptr: *mut bindings::watchdog_device ) -> &'aSelf {
[Severity: Low]
This isn't a bug, but should small or forwarding functions in abstractions, such as from_raw(), as_raw(), and the various getter/setter methods below, be annotated with #[inline] according to the Rust subsystem guidelines?
Quoted 17 lines
rust/kernel/watchdog.rs new file +17
-0+// CAST: `Self` is a `repr(transparent)` wrapper around +// `bindings::watchdog_device`. +let ptr = ptr.cast ::<Self >(); +// SAFETY: By the function requirements the pointer is valid. +unsafe { &*ptr } + } + +/// Returns a raw pointer to the underlying `watchdog_device`. +fn as_raw (&self) -> *mut bindings::watchdog_device { + self.0 .get () + } + +/// Returns the current timeout in seconds. +pub fn timeout (&self) ->u32 { +// SAFETY: The struct invariant ensures the pointer is valid. The +// read of this `unsigned int` field mirrors how the C core and C +// drivers access it without synchronisation.
rust/kernel/watchdog.rs line 64
Quoted 10 lines
rust/kernel/watchdog.rs new file +10
-0+unsafe { (*self.as_raw ()).timeout } + } + +/// Sets the current timeout in seconds. +pub fn set_timeout (&self, timeout:u32 ) { +// SAFETY: The struct invariant ensures the pointer is valid. The +// field lives in an `Opaque`, so writing through a shared reference +// is allowed; the C core accesses this field the same way. +unsafe { (*self.as_raw ()).timeout = timeout }; + }
[Severity: High]
Since the commit message notes that callbacks can run concurrently without holding a lock, does exposing these safe read and write methods cause a data race when accessed from multiple threads?
In Rust, unsynchronized concurrent access where at least one is a write constitutes undefined behavior. Should these methods use volatile or atomic accesses to mirror READ_ONCE/WRITE_ONCE, or require caller synchronization?
rust/kernel/watchdog.rs line 70
Quoted 6 lines
rust/kernel/watchdog.rs new file +6
-0+ +/// Returns the current pretimeout in seconds. +pub fn pretimeout (&self) ->u32 { +// SAFETY: See `timeout`. +unsafe { (*self.as_raw ()).pretimeout } + }
[Severity: High]
If a driver provides a set_pretimeout callback, the C watchdog core expects the driver to update the internal wdd->pretimeout field upon success.
Since the Device abstraction only provides a getter for pretimeout, how can a Rust driver correctly update this core state without a set_pretimeout() method?
Quoted 3 lines
rust/kernel/watchdog.rs new file +3
-0+ +/// Returns the minimum timeout in seconds. +pub fn min_timeout (&self) ->u32 {
[ ... ]
Quoted 6 lines
rust/kernel/watchdog.rs new file +6
-0+pub struct Options { +/// The default timeout in seconds. +pub timeout:u32 , +/// The minimum settable timeout in seconds. +pub min_timeout:u32 , +/// The maximum settable timeout in seconds.
rust/kernel/watchdog.rs line 162
Quoted 10 lines
rust/kernel/watchdog.rs new file +10
-0+ pub max_timeout: u32, +/// Hardware limit for the maximum timeout, in milliseconds. +/// Zero means no hardware limit. + pub max_hw_heartbeat_ms: u32, +/// If `true`, the watchdog cannot be stopped once started. + pub nowayout: bool, +/// If `true`, the watchdog is stopped on system reboot. Requires a +/// [`WatchdogOps::stop`] implementation. + pub stop_on_reboot: bool, +}
[Severity: High]
Are commonly required driver fields like bootstatus and min_hw_heartbeat_ms missing from this Options struct?
Because missing fields are zero-initialized in Registration::register() and there are no setters in Device, are drivers unable to configure these standard features, such as reporting WDIOF_CARDRESET?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
PATCH v2 2/3 rust: reboot: add emergency_restart() wrapper
In reply to Artem LytkinAdd a minimal reboot module wrapping emergency_restart(), which restarts the machine immediately without syncing or unmounting filesystems.
This is needed by watchdog drivers that must restart the system when the watchdog expires, such as the Rust software watchdog added in a subsequent patch. emergency_restart() is safe to call from any context, including the interrupt context of an expiring timer.
--- rust/bindings/bindings_helper.h | 1 + rust/kernel/lib.rs | 1 + rust/kernel/reboot.rs | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 rust/kernel/reboot.rs
rust/bindings/bindings_helper.h +1 -0
@@ -81,6 +81,7 @@#include <linux/property.h> #include <linux/pwm.h> #include <linux/random.h> +#include <linux/reboot.h> #include <linux/refcount.h> #include <linux/regulator/consumer.h> #include <linux/sched.h>
rust/kernel/lib.rs +1 -0
@@ -113,6 +113,7 @@#[cfg( CONFIG_RUST_PWM_ABSTRACTIONS )] pub mod pwm;pub mod rbtree; +pub mod reboot;pub mod regulator;pub mod revocable;pub mod safety;
rust/kernel/reboot.rs new file +19 -0
@@ -0,0 +1,19 @@ +// SPDX-License-Identifier: GPL-2.0 + +//! Reboot support. +//! +//! C header: [`include/linux/reboot.h`](srctree/include/linux/reboot.h). + +use crate ::bindings; + +/// Restarts the machine immediately, without syncing or unmounting +/// filesystems and without going through the reboot notifier chains. +/// +/// This is intended for situations where the system is in a state where an +/// orderly shutdown is no longer possible, for example when a watchdog +/// expires. It can be called from any context, including interrupt context. +pub fn emergency_restart () { +// SAFETY: `emergency_restart` has no preconditions and is documented as +// safe to call from any context. +unsafe { bindings::emergency_restart () } +}
Signature · 1 line
2.43.0
[email protected]
AI reviewRe: [PATCH v2 2/3] rust: reboot: add emergency_restart() wrapper
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] Missing `#[inline]` annotation on the `emergency_restart` abstraction function. --
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Missing #[inline] annotation on the emergency_restart abstraction function. --
--- Patch [2]: [PATCH v2 2/3] rust: reboot: add emergency_restart() wrapper --- commit 13ef5d00452d4b8320913eb2ed361d92083a6263
Author: Artem Lytkin <[email protected]>
rust: reboot: add emergency_restart() wrapper
This commit adds a minimal reboot module wrapping the emergency_restart function. This allows Rust watchdog drivers to restart the machine immediately without syncing or unmounting filesystems.
Quoted 5 lines
rust/kernel/reboot.rs new file +0
-0
[ ... ]
rust/kernel/reboot.rs line 15
Quoted 4 lines
rust/kernel/reboot.rs new file +4
-0+/// This is intended for situations where the system is in a state where an +/// orderly shutdown is no longer possible, for example when a watchdog +/// expires. It can be called from any context, including interrupt context. +pub fn emergency_restart () {
[Severity: Low]
This isn't a bug, but since this function is small and forwards directly to a C binding, should it be annotated with #[inline] to match the Rust subsystem guidelines for abstractions?
Quoted 4 lines
rust/kernel/reboot.rs new file +4
-0+// SAFETY: `emergency_restart` has no preconditions and is documented as +// safe to call from any context. +unsafe { bindings::emergency_restart () } +}
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
PATCH v2 3/3 watchdog: softdog_rs: add Rust software watchdog driver
In reply to Artem LytkinAdd a Rust software watchdog driver using the Rust watchdog abstraction, functionally equivalent to the core of the C softdog driver.
An hrtimer is armed on start and re-armed on every keepalive ping for the currently configured timeout. If userspace stops pinging, the timer expires and the system is restarted via emergency_restart(), matching the C softdog default behaviour. Stopping the watchdog cancels the timer. The timer handle is protected by a mutex since watchdog callbacks may run concurrently.
Two implementation notes:
- Re-arming cancels the previous timer before starting it again (the hrtimer handle API cancels on drop), so a ping can briefly block on a concurrently firing callback and there is a tiny disarmed window during re-arm. A future handle restart API would eliminate this.
- The C softdog pins the module manually while the timer is armed; this driver gets equivalent protection from the watchdog core, which holds the module reference while the device is open or the hardware watchdog is marked running, so module unload is blocked while the timer is armed.
The timeout is adjustable from userspace via WDIOC_SETTIMEOUT; since the driver has no set_timeout operation, the watchdog core updates the timeout directly and the new value takes effect on the next ping.
The Kconfig option uses SOFT_WATCHDOG=n (rather than !SOFT_WATCHDOG, which would still allow both as modules) so that the C and Rust software watchdogs are mutually exclusive.
--- drivers/watchdog/Kconfig | 12 +++ drivers/watchdog/Makefile | 1 + drivers/watchdog/softdog_rs.rs | 143 +++++++++++++++++++++++++++++++++ 3 files changed, 156 insertions(+) create mode 100644 drivers/watchdog/softdog_rs.rs
drivers/watchdog/Kconfig +12 -0
@@ -160,6 +160,18 @@ config SOFT_WATCHDOG To compile this driver as a module, choose M here: the module will be called softdog. +config SOFT_WATCHDOG_RS + tristate "Rust software watchdog" + depends on RUST && SOFT_WATCHDOG=n + select WATCHDOG_CORE + help + A software watchdog driver written in Rust using the Rust watchdog + device abstraction. This is a Rust equivalent of the C softdog + driver. + + To compile this driver as a module, choose M here: the + module will be called softdog_rs. + config SOFT_WATCHDOG_PRETIMEOUT bool "Software watchdog pretimeout governor support" depends on SOFT_WATCHDOG && WATCHDOG_PRETIMEOUT_GOV
drivers/watchdog/Makefile +1 -0
@@ -236,6 +236,7 @@ obj-$(CONFIG_MAX77620_WATCHDOG) += max77620_wdt.o obj-$(CONFIG_NCT6694_WATCHDOG) += nct6694_wdt.o obj-$(CONFIG_ZIIRAVE_WATCHDOG) += ziirave_wdt.o obj-$(CONFIG_SOFT_WATCHDOG) += softdog.o +obj-$(CONFIG_SOFT_WATCHDOG_RS) += softdog_rs.o obj-$(CONFIG_MENF21BMC_WATCHDOG) += menf21bmc_wdt.o obj-$(CONFIG_MENZ069_WATCHDOG) += menz69_wdt.o obj-$(CONFIG_RAVE_SP_WATCHDOG) += rave-sp-wdt.o
drivers/watchdog/softdog_rs.rs new file +143 -0
143 lines not on this page · raw message
Signature · 1 line
2.43.0
kernel test robot
build botRe: [PATCH v2 3/3] watchdog: softdog_rs: add Rust software watchdog driver
kernel test robot noticed the following build warnings:
Hi Artem,
kernel test robot noticed the following build warnings:
[auto build test WARNING on rust/rust-next]
[also build test WARNING on linus/master v7.2 next-20260721] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Artem-Lytkin/rust-watchdog-add-watchdog-device-abstraction/20260813-051424 base: https://github.com/Rust-for-Linux/linux rust-next patch link: https://lore.kernel.org/r/20260723161529.23759-4-iprintercanon%40gmail.com patch subject: [PATCH v2 3/3] watchdog: softdog_rs: add Rust software watchdog driver config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20260817/[email protected]/config) compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1) rustc: rustc 1.96.0 (ac68faa20 2026-05-25) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260817/[email protected]/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All warnings (new ones prefixed by >>):
>> warning: this `impl` can be derived
--> rust/kernel/watchdog.rs:164:1
|
164 | / impl Default for Options {
165 | | fn default() -> Self {
166 | | Self {
167 | | timeout: 0,
... |
175 | | }
| |_^
| = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.96.0/index.html#derivable_impls
= note: -W clippy::derivable-impls implied by -W clippy::all
= help: to override -W clippy::all add #[allow(clippy::derivable_impls)]
help: replace the manual implementation with a derive attribute
|
147 + #[derive(Default)]
148 | pub struct Options {
|
--
>> warning: unresolved link to `super::Info::new`
--> rust/kernel/watchdog.rs:98:7
|
98 | /// [super::Info::new].
| ^^^^^^^^^^^^^^^^ no item named Info in module kernel
|
= note: #[warn(rustdoc::broken_intra_doc_links)] on by default
--
>> warning: public documentation for `Registration` links to private item `Inner`
--> rust/kernel/watchdog.rs:392:34
|
392 | /// - inner points at a live [Inner] obtained from [KBox::into_raw],
| ^^^^^ this item is private
|
= note: this link will resolve properly if you pass --document-private-items = note: #[warn(rustdoc::private_intra_doc_links)] on by default
--
>> warning: public documentation for `Registration` links to private item `Inner`
--> rust/kernel/watchdog.rs:395:45
|
395 | /// the ops and data fields of that [Inner].
| ^^^^^ this item is private
|
= note: this link will resolve properly if you pass --document-private-items
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki