diff options
| author | Matthew Garrett <mjg59@google.com> | 2017-08-25 17:50:15 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-08-26 09:20:33 +0200 |
| commit | ccc829ba3624beb9a703fc995d016b836d9eead8 (patch) | |
| tree | b1791e31decb96c4fad4cd24b6b9dce5a351d2eb /drivers/firmware/efi/libstub/Makefile | |
| parent | Merge branch 'x86/mm' into efi/core, to pick up dependencies (diff) | |
| download | linux-ccc829ba3624beb9a703fc995d016b836d9eead8.tar.xz linux-ccc829ba3624beb9a703fc995d016b836d9eead8.zip | |
efi/libstub: Enable reset attack mitigation
If a machine is reset while secrets are present in RAM, it may be
possible for code executed after the reboot to extract those secrets
from untouched memory. The Trusted Computing Group specified a mechanism
for requesting that the firmware clear all RAM on reset before booting
another OS. This is done by setting the MemoryOverwriteRequestControl
variable at startup. If userspace can ensure that all secrets are
removed as part of a controlled shutdown, it can reset this variable to
0 before triggering a hardware reboot.
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/20170825155019.6740-2-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/firmware/efi/libstub/Makefile')
| -rw-r--r-- | drivers/firmware/efi/libstub/Makefile | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index cf81e6cf5ae8..dedf9bde44db 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -30,6 +30,7 @@ OBJECT_FILES_NON_STANDARD := y KCOV_INSTRUMENT := n lib-y := efi-stub-helper.o gop.o secureboot.o +lib-$(CONFIG_RESET_ATTACK_MITIGATION) += tpm.o # include the stub's generic dependencies from lib/ when building for ARM/arm64 arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c |