U-Boot can autonomously start a hardware watchdog (CONFIG_WATCHDOG_AUTOSTART, default y) and service it from its main loop, but the EFI boot path never stops it: efi_exit_boot_services() tears the devices down without calling wdt_stop_all(), and a watchdog driver without a .remove hook leaves the hardware ticking across the firmware-to-OS handoff.
An EFI-booted OS that does not take over the SoC watchdog within the remaining timeout is reset mid-boot at a wall-clock-dependent point. The UEFI specification (v2.11, section 7.5 "Miscellaneous Boot Services", EFI_BOOT_SERVICES.SetWatchdogTimer()) is explicit about the one watchdog it allows across the handoff: "The watchdog timer is only used during boot services. On successful completion of EFI_BOOT_SERVICES.ExitBootServices() the watchdog timer is disabled." U-Boot's UEFI watchdog (an EFI timer event) complies by construction. A platform watchdog silently surviving the handoff defeats the purpose of that rule: the OS has no generic way to know it is running, let alone to service it. Stop all watchdog devices in efi_exit_boot_services(), before the device teardown. Signed-off-by: Carlo Caione <[email protected]> --- lib/efi_loader/efi_boottime.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index de57823bd44..9588d9b9739 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -22,6 +22,7 @@ #include <u-boot/crc.h> #include <usb.h> #include <watchdog.h> +#include <wdt.h> #include <asm/global_data.h> #include <linux/libfdt_env.h> @@ -2245,6 +2246,8 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle, if (IS_ENABLED(CONFIG_DM_ETH)) eth_halt(); board_quiesce_devices(); + if (IS_ENABLED(CONFIG_WDT)) + wdt_stop_all(); dm_remove_devices_active(); } -- 2.55.0
