On 17.12.21 15:31, Kristian Klausen wrote: > On Fri, Dec 17, 2021 at 14:47:23 +0100, Jan Kiszka wrote: >> On 17.12.21 14:06, 'Kristian Klausen' via EFI Boot Guard wrote: >>> Hi >>> >>> This project is what I have been looking for (secure boot + watchdog), >>> but I have a hard time grasping why it works. >>> >>> The UEFI spec states[1]: >>> "The watchdog timer is only used during boot services. On successful >>> completion of EFI_BOOT_SERVICES.ExitBootServices() the watchdog timer is >>> disabled." >>> >>> So the boot looke something like this (AFAIU): >>> 1. efibootguard starts >>> 2. efibootguard initializes the watchdog >>> 3. LoadImage() >>> 4. StartImage() >>> 5. Linux starts and calls ExitBootServices() >>> >>> Why isn't UEFI disabling the watchdog initialized by efibootguard when >>> ExitBootServices() is called? >>> >>> [1] UEFI Spec 2.6, EFI_BOOT_SERVICES.SetWatchdogTimer(): >>> >> >> Actually, this limitation of the UEFI-specified watchdog is one of the >> reasons EFI Boot Guard exists. Here, we don't use the UEFI-provided >> watchdog but real ones (including those described via WDAT, but those >> are HW watchdogs as well). And those real watchdogs will not stop when >> the boot services are terminated. Rather, Linux will pick them up and >> continue to drive them. > > Thanks for the explanation, is the "UEFI-specified watchdog" not using > the hardware watchdog? or how is efibootguard preventing UEFI from > messing with the watchdog? > > According to the spec UEFI will disable the watchdog when > ExitBootServices() is called. I assume that is still happening with > efibootguard?
Honestly, I have no clue how UEFI implementations map the watchdog API requests on real hardware. So far, we have not seen any conflicts in practice, probably because that UEFI watchdog service is generally not requested (definitely not by EFI Boot Guard). Adding Francois for this topic. Maybe he can shed a light on the interaction of SetWatchdogTimer() and hardware watchdogs. Jan -- Siemens AG, T RDA IOT Corporate Competence Center Embedded Linux -- You received this message because you are subscribed to the Google Groups "EFI Boot Guard" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/efibootguard-dev/36d58cd3-332f-daeb-f695-79b7a0f57285%40siemens.com.
