On 17.12.21 14:06, 'Kristian Klausen' via EFI Boot Guard wrote: > Hi > > This project is what I have been looking for (secure boot + watchdog), > but I have a hard time grasping why it works. > > The UEFI spec states[1]: > "The watchdog timer is only used during boot services. On successful > completion of EFI_BOOT_SERVICES.ExitBootServices() the watchdog timer is > disabled." > > So the boot looke something like this (AFAIU): > 1. efibootguard starts > 2. efibootguard initializes the watchdog > 3. LoadImage() > 4. StartImage() > 5. Linux starts and calls ExitBootServices() > > Why isn't UEFI disabling the watchdog initialized by efibootguard when > ExitBootServices() is called? > > [1] UEFI Spec 2.6, EFI_BOOT_SERVICES.SetWatchdogTimer(): >
Actually, this limitation of the UEFI-specified watchdog is one of the reasons EFI Boot Guard exists. Here, we don't use the UEFI-provided watchdog but real ones (including those described via WDAT, but those are HW watchdogs as well). And those real watchdogs will not stop when the boot services are terminated. Rather, Linux will pick them up and continue to drive them. Jan -- Siemens AG, T RDA IOT Corporate Competence Center Embedded Linux -- You received this message because you are subscribed to the Google Groups "EFI Boot Guard" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/efibootguard-dev/f31ea433-a44d-6540-f19e-6a050210f4d6%40siemens.com.
