[PATCH] efi_loader: stop watchdog devices in ExitBootServices()

[Carlo Caione]

U-Boot can autonomously start a hardware watchdog
(CONFIG_WATCHDOG_AUTOSTART, default y) and service it from its main
loop, but the EFI boot path never stops it: efi_exit_boot_services()
tears the devices down without calling wdt_stop_all(), and a watchdog
driver without a .remove hook leaves the hardware ticking across the
firmware-to-OS handoff.

An EFI-booted OS that does not take over the SoC watchdog within the
remaining timeout is reset mid-boot at a wall-clock-dependent point.

The UEFI specification (v2.11, section 7.5 "Miscellaneous Boot
Services", EFI_BOOT_SERVICES.SetWatchdogTimer()) is explicit about the
one watchdog it allows across the handoff:

  "The watchdog timer is only used during boot services. On
   successful completion of EFI_BOOT_SERVICES.ExitBootServices() the
   watchdog timer is disabled."

U-Boot's UEFI watchdog (an EFI timer event) complies by construction. A
platform watchdog silently surviving the handoff defeats the purpose of
that rule: the OS has no generic way to know it is running, let alone to
service it.

Stop all watchdog devices in efi_exit_boot_services(), before the device
teardown.

Signed-off-by: Carlo Caione <ccaione at baylibre.com>
---
 lib/efi_loader/efi_boottime.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index de57823bd44..9588d9b9739 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -22,6 +22,7 @@
 #include <u-boot/crc.h>
 #include <usb.h>
 #include <watchdog.h>
+#include <wdt.h>
 #include <asm/global_data.h>
 #include <linux/libfdt_env.h>
 
@@ -2245,6 +2246,8 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
 		if (IS_ENABLED(CONFIG_DM_ETH))
 			eth_halt();
 		board_quiesce_devices();
+		if (IS_ENABLED(CONFIG_WDT))
+			wdt_stop_all();
 		dm_remove_devices_active();
 	}
 
-- 
2.55.0