x86/efi: Clarify that reset attack mitigation needs appropriate userspace

Some distributions have turned on the reset attack mitigation feature,
which is designed to force the platform to clear the contents of RAM if
the machine is shut down uncleanly. However, in order for the platform
to be able to determine whether the shutdown was clean or not, userspace
has to be configured to clear the MemoryOverwriteRequest flag on
shutdown - otherwise the firmware will end up clearing RAM on every
reboot, which is unnecessarily time consuming. Add some additional
clarity to the kconfig text to reduce the risk of systems being
configured this way.

Signed-off-by: Matthew Garrett <[email protected]>
Acked-by: Ard Biesheuvel <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Ingo Molnar <[email protected]>

diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index aab108e82f788b218291b8fba781e2c6994a4058..6047ed4e8a3d613be04b9487b29749f96e82cc18 100644 (file)
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -159,7 +159,10 @@ config RESET_ATTACK_MITIGATION
          using the TCG Platform Reset Attack Mitigation specification. This
          protects against an attacker forcibly rebooting the system while it
          still contains secrets in RAM, booting another OS and extracting the
-         secrets.
+         secrets. This should only be enabled when userland is configured to
+         clear the MemoryOverwriteRequest flag on clean shutdown after secrets
+         have been evicted, since otherwise it will trigger even on clean
+         reboots.
 
 endmenu