Re: [PATCH 1/2] hw/misc/bcm2835_powermgt: implement a real watchdog timer

On Sun, 26 Jul 2026 at 00:11, Marcelo Manzo <[email protected]> wrote:
>
> The RSTC register's write-config bits (0x30) being set to the
> "full reset" value (0x20) does not mean "reset now" -- it arms the
> hardware watchdog so that a reset happens if the WDOG countdown
> register is not refreshed before it expires. The previous
> implementation treated any such RSTC write as an immediate reset,
> regardless of the WDOG value.
>
> This is dormant on older/lighter userspace (nothing in Bullseye's
> default boot touches these registers this way), but modern systemd
> (observed with Debian 13/Trixie's systemd 257) writes to RSTC as part
> of routine early-boot watchdog probing. With the old code, this fires
> an immediate reset a few seconds into boot; combined with -no-reboot
> this looks exactly like a QEMU crash (clean exit, no panic, no guest
> reboot message) with the last log line being the RSTC/WDOG write.
>
> Fix this by actually implementing the watchdog as a QEMUTimer: writes
> to RSTC/WDOG (re)compute the timeout from the WDOG register (in units
> of 1/65536 s, per the real hardware) and arm a timer for that many
> nanoseconds out; only when the timer actually fires do we request a
> system reset or shutdown, matching real hardware behavior. Clearing
> the write-config bits or the WDOG value disarms the timer, and reset
> disarms it too.
>
> Verified against real Raspberry Pi OS images under the patched
> raspi4b machine: Bullseye (5.15) and Bookworm (6.12) never exercised
> this path either way; Trixie (6.18, systemd 257) no longer crashes at
> boot and reaches a working login/SSH state.
>
> Signed-off-by: Marcelo Manzo <[email protected]>

> @@ -113,6 +136,7 @@ static const VMStateDescription vmstate_bcm2835_powermgt = {
>          VMSTATE_UINT32(rstc, BCM2835PowerMgtState),
>          VMSTATE_UINT32(rsts, BCM2835PowerMgtState),
>          VMSTATE_UINT32(wdog, BCM2835PowerMgtState),
> +        VMSTATE_TIMER_PTR(wdog_timer, BCM2835PowerMgtState),
>          VMSTATE_END_OF_LIST()

If we add a field to the vmstate we should also increment the
version_id and minimum_version_id, and note in the commit message
that this is a migration break for the affected machine types.
(We're OK to break migration compat for raspi because it's not
a versioned machine type.)

I couldn't find any h/w docs for the watchdog (is it one of
the undocumented devices on this SoC?), but this all looks
right and matches how the Linux driver uses this register.

Since the version bump was the only issue here, I've applied
this patch to target-arm.next ready for when we re-open
development for 11.2, with that tweak made.

thanks
-- PMM