[efi] Hold off watchdog timer while running

UEFI platforms may provide a watchdog timer, which will reboot the
machine if an operating system takes more than five minutes to load.
This can cause long-lived iPXE downloads (or interactive shell
sessions) to unexpectedly reboot.

Fix by resetting the watchdog timer every ten seconds while the iPXE
main processing loop continues to run.

Reported-by: Bradley B Williams <bradleybwilliams@swbell.net>
Reported-by: John Clark <john.r.clark.3@gmail.com>
Reported-by: wdriever@gmail.com
Reported-by: Charlie Beima <cbeima@indiana.edu>
Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/arch/x86/prefix/efiprefix.c

@@ -26,6 +26,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #include <ipxe/efi/efi_driver.h>
 #include <ipxe/efi/efi_snp.h>
 #include <ipxe/efi/efi_autoboot.h>
+#include <ipxe/efi/efi_watchdog.h>
 
 /**
  * EFI entry point
@@ -49,6 +50,9 @@ EFI_STATUS EFIAPI _efi_start ( EFI_HANDLE image_handle,
 	/* Claim SNP devices for use by iPXE */
 	efi_snp_claim();
 
+	/* Start watchdog holdoff timer */
+	efi_watchdog_start();
+
 	/* Call to main() */
 	if ( ( rc = main() ) != 0 ) {
 		efirc = EFIRC ( rc );
@@ -56,6 +60,7 @@ EFI_STATUS EFIAPI _efi_start ( EFI_HANDLE image_handle,
 	}
 
  err_main:
+	efi_watchdog_stop();
 	efi_snp_release();
 	efi_loaded_image->Unload ( image_handle );
 	efi_driver_reconnect_all();

src/include/ipxe/efi/efi_watchdog.h

@@ -0,0 +1,31 @@
+#ifndef _IPXE_EFI_WATCHDOG_H
+#define _IPXE_EFI_WATCHDOG_H
+
+/** @file
+ *
+ * EFI watchdog holdoff timer
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+extern struct retry_timer efi_watchdog;
+
+/**
+ * Start EFI watchdog holdoff timer
+ *
+ */
+static inline void efi_watchdog_start ( void ) {
+
+	start_timer_nodelay ( &efi_watchdog );
+}
+
+/**
+ * Stop EFI watchdog holdoff timer
+ *
+ */
+static inline void efi_watchdog_stop ( void ) {
+
+	stop_timer ( &efi_watchdog );
+}
+
+#endif /* _IPXE_EFI_WATCHDOG_H */

src/include/ipxe/errfile.h

@@ -330,6 +330,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define ERRFILE_efi_wrap	      ( ERRFILE_OTHER | 0x00460000 )
 #define ERRFILE_vmbus		      ( ERRFILE_OTHER | 0x00470000 )
 #define ERRFILE_efi_time	      ( ERRFILE_OTHER | 0x00480000 )
+#define ERRFILE_efi_watchdog	      ( ERRFILE_OTHER | 0x00490000 )
 
 /** @} */
 

src/interface/efi/efi_snp.c

@@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #include <ipxe/efi/efi_driver.h>
 #include <ipxe/efi/efi_strings.h>
 #include <ipxe/efi/efi_utils.h>
+#include <ipxe/efi/efi_watchdog.h>
 #include <ipxe/efi/efi_snp.h>
 #include <usr/autoboot.h>
 #include <config/general.h>
@@ -881,9 +882,15 @@ efi_snp_load_file ( EFI_LOAD_FILE_PROTOCOL *load_file,
 	/* Claim network devices for use by iPXE */
 	efi_snp_claim();
 
+	/* Start watchdog holdoff timer */
+	efi_watchdog_start();
+
 	/* Boot from network device */
 	ipxe ( netdev );
 
+	/* Stop watchdog holdoff timer */
+	efi_watchdog_stop();
+
 	/* Release network devices for use via SNP */
 	efi_snp_release();
 

src/interface/efi/efi_watchdog.c

@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2015 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+/**
+ * @file
+ *
+ * EFI watchdog holdoff timer
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <ipxe/retry.h>
+#include <ipxe/timer.h>
+#include <ipxe/efi/efi.h>
+#include <ipxe/efi/efi_watchdog.h>
+
+/** Watchdog holdoff interval (in seconds) */
+#define WATCHDOG_HOLDOFF_SECS 10
+
+/** Watchdog timeout (in seconds) */
+#define WATCHDOG_TIMEOUT_SECS ( 5 * 60 )
+
+/** Watchdog code (to be logged on watchdog timeout) */
+#define WATCHDOG_CODE 0x6950584544454144
+
+/** Watchdog data (to be logged on watchdog timeout) */
+#define WATCHDOG_DATA L"iPXE";
+
+/**
+ * Hold off watchdog timer
+ *
+ * @v retry		Retry timer
+ * @v over		Failure indicator
+ */
+static void efi_watchdog_expired ( struct retry_timer *timer,
+				   int over __unused ) {
+	EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
+	static CHAR16 data[] = WATCHDOG_DATA;
+	EFI_STATUS efirc;
+	int rc;
+
+	DBGC2 ( timer, "EFI holding off watchdog timer\n" );
+
+	/* Restart this holdoff timer */
+	start_timer_fixed ( timer, ( WATCHDOG_HOLDOFF_SECS * TICKS_PER_SEC ) );
+
+	/* Reset watchdog timer */
+	if ( ( efirc = bs->SetWatchdogTimer ( WATCHDOG_TIMEOUT_SECS,
+					      WATCHDOG_CODE, sizeof ( data ),
+					      data ) ) != 0 ) {
+		rc = -EEFI ( efirc );
+		DBGC ( timer, "EFI could not set watchdog timer: %s\n",
+		       strerror ( rc ) );
+		return;
+	}
+}
+
+/** Watchdog holdoff timer */
+struct retry_timer efi_watchdog = TIMER_INIT ( efi_watchdog_expired );