BCM SoC hardware watchdog and systemd RuntimeWatchdog: arm state across warm reboot vs power cycle

Direct Answer

On current Raspberry Pi 4 (BCM2711) and Pi 5 (BCM2712/RP1) with bootloader firmware dated 2023-07-10 or later: the hardware watchdog does not remain armed across a warm reboot. The bootloader explicitly disarms the SoC watchdog early in the boot sequence before handing control to the kernel. A full power cycle also leaves the watchdog disarmed (reset).

This behavior is a consequence of the default EEPROM setting POWER_OFF_ON_HALT=1, which causes even a systemctl reboot to cycle the PMIC power rails — effectively making a warm reboot indistinguishable from a power cycle for watchdog state purposes.

Confirmed Facts by Generation

Pi 4 (BCM2711)

• Single SoC watchdog exposed via bcm2835-wdt driver at /dev/watchdog0.
• Bootloader (EEPROM) disarms it during early boot on firmware ≥ 2023-07-10.
• Hardware timeout configurable via kernel parameter bcm2835_wdt.heartbeat= (range ~1–16 s, default 10 s).

Pi 5 (BCM2712 + RP1)

• Two independent watchdogs: SoC watchdog (bcm2835-wdt compatible) and RP1 southbridge watchdog (rp1-wdt).
• Both are disarmed by their respective firmware/bootloader components on current releases.
• Systemd uses the first registered /dev/watchdog (typically the SoC watchdog). Verify with ls -la /dev/watchdog* and dmesg | grep -E '(bcm2835|rp1).*wdt'.

nowayout Parameter

Raspberry Pi kernels ship with nowayout=Y (check /sys/module/bcm2835_wdt/parameters/nowayout). This means:

• Once userspace opens /dev/watchdog, it cannot disarm the watchdog by closing the file descriptor.
• Only a hardware reset, bootloader action, or kernel reboot disarms it.
• If systemd crashes after opening the device without rebooting, the watchdog will fire.

RuntimeWatchdogSec Sizing

Set the hardware heartbeat first via kernel command line (e.g., bcm2835_wdt.heartbeat=10 in /boot/firmware/cmdline.txt), then choose systemd values:

• RuntimeWatchdogSec: strictly less than hardware timeout. Recommended: 7 (for 10 s hardware timeout).
• ShutdownWatchdogSec: longer than worst-case shutdown. Recommended: 30.

If RuntimeWatchdogSec >= hardware timeout, systemd's ping interval may be clamped or missed, causing spurious resets.

Verification Steps (Run on Target Device)

1. dmesg -T | grep -i watchdog — confirm driver load, reported timeout, and nowayout status.
2. cat /sys/class/watchdog/watchdog0/timeout — shows current kernel timeout in seconds.
3. rpi-eeprom-config (Pi 4/5) or vcgencmd bootloader_version (Pi 4) — verify bootloader ≥ 2023-07-10.
4. Enable RuntimeWatchdogSec=7 in /etc/systemd/system.conf, run systemctl reboot, then check journalctl -b -1 | grep -i watchdog for any spurious reset messages during the previous boot.

One Diagnostic Detail Needed

What is the output of rpi-eeprom-config (or vcgencmd bootloader_version on Pi 4) on your device? If the bootloader is older than 2023-07-10, the watchdog may remain armed across warm reboot, changing the recommended RuntimeWatchdogSec margin.