From: Matthew Garrett <mjg59@coreos.com>
Date: Tue, 12 Jan 2016 20:51:27 +0000 (-0800)
Subject: Enable cold boot attack mitigation
X-Git-Tag: archive/raspbian/4.9.82-1+deb9u3+rpi1_jessie~8^2~33
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ad7d540e8f4546c5df8718fa31bcb496ee8d3dfe;p=linux-4.9.git

Enable cold boot attack mitigation


Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name enable-cold-boot-attack-mitigation.patch
---

diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index e042f00cd9f7..715ccf95a430 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -711,6 +711,22 @@ void setup_graphics(struct boot_params *boot_params)
 	}
 }
 
+#define MEMORY_ONLY_RESET_CONTROL_GUID \
+	EFI_GUID (0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29)
+
+static void enable_reset_attack_mitigation(void)
+{
+	u8 val = 1;
+	efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID;
+
+	/* Ignore the return value here - there's not really a lot we can do */
+	efi_early->call((unsigned long)sys_table->runtime->set_variable,
+			L"MemoryOverwriteRequestControl", &var_guid,
+			EFI_VARIABLE_NON_VOLATILE |
+			EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			EFI_VARIABLE_RUNTIME_ACCESS, sizeof(val), val);
+}
+
 static int get_secure_boot(void)
 {
 	u8 sb, setup, moksbstate;
@@ -1144,6 +1160,12 @@ struct boot_params *efi_main(struct efi_config *c,
 	else
 		setup_boot_services32(efi_early);
 
+	/*
+	 * Ask the firmware to clear memory if we don't have a clean
+	 * shutdown
+	 */
+	enable_reset_attack_mitigation();
+
 	sanitize_boot_params(boot_params);
 
 	boot_params->secure_boot = get_secure_boot();