> > This project is what I have been looking for (secure boot + watchdog), > > but I have a hard time grasping why it works. > > > > The UEFI spec states[1]: > > "The watchdog timer is only used during boot services. On successful > > completion of EFI_BOOT_SERVICES.ExitBootServices() the watchdog timer is > > disabled." > > > > So the boot looke something like this (AFAIU): > > 1. efibootguard starts > > 2. efibootguard initializes the watchdog > > 3. LoadImage() > > 4. StartImage() > > 5. Linux starts and calls ExitBootServices() > > > > Why isn't UEFI disabling the watchdog initialized by efibootguard when > > ExitBootServices() is called? > > > > [1] UEFI Spec 2.6, EFI_BOOT_SERVICES.SetWatchdogTimer(): > > > > Actually, this limitation of the UEFI-specified watchdog is one of the > reasons EFI Boot Guard exists. Here, we don't use the UEFI-provided > watchdog but real ones (including those described via WDAT, but those > are HW watchdogs as well). And those real watchdogs will not stop when > the boot services are terminated. Rather, Linux will pick them up and > continue to drive them.
Just for reference, here's EDK2's event-based watchdog implementation: https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.c#L208 This one supervises the EFI domain until the ExitBootServices() call ― including a stalled EFI Boot Guard prior to having enabled a hardware watchdog. After EFI Boot Guard has enabled a hardware watchdog, this is additionally running and not affected by ExitBootServices() as UEFI doesn't care about it. With this, you bridge the gap between ExitBootServices() and the Kernel driving the hardware watchdog not being watchdog-supervised. Technically, EFI Boot Guard's watchdog drivers could've also been implemented as a set of UEFI drivers with the same effect (but a harder deployment), then leaving only the switching logics to EFI Boot Guard. Kind regards, Christian -- Dr. Christian Storm Siemens AG, Technology, T RDA IOT SES-DE Otto-Hahn-Ring 6, 81739 München, Germany -- You received this message because you are subscribed to the Google Groups "EFI Boot Guard" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/efibootguard-dev/20211217143735.hvg66vvowp7bwjmj%40MD1ZFJVC.ad001.siemens.net.
