diff mbox series

[1/3] linux: Enable Indirect Branch Tracking by default

Message ID d753cd03-007f-d78c-848e-cc72459fded8@ipfire.org
State Staged
Commit c084d8f970b428ef043aab0263c0f2a8c2f814f5
Headers
Series [1/3] linux: Enable Indirect Branch Tracking by default |

Commit Message

Peter Müller July 9, 2023, 2:55 p.m. UTC 
  This became upstream default (see
https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media
coverage), and given its security-relevance, we should adopt this
setting as well.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 config/kernel/kernel.config.x86_64-ipfire | 2 +-
 config/rootfiles/common/x86_64/linux      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

Comments

Michael Tremer July 10, 2023, 5:33 p.m. UTC | #1
Addressed 
Hello Peter,

I am happy with this going in, but we should also enable this in user space, too.

I will take care of this and post a patch soon. I don’t think all fits into one update, so I believe we should release this and follow up with the user space whenever suitable.

Best,
-Michael

Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

> On 9 Jul 2023, at 15:55, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> This became upstream default (see
> https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media
> coverage), and given its security-relevance, we should adopt this
> setting as well.
> 
> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
> ---
> config/kernel/kernel.config.x86_64-ipfire | 2 +-
> config/rootfiles/common/x86_64/linux      | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index 6c880ca8a..d70a19656 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -431,7 +431,7 @@ CONFIG_X86_PAT=y
> CONFIG_ARCH_USES_PG_UNCACHED=y
> CONFIG_X86_UMIP=y
> CONFIG_CC_HAS_IBT=y
> -# CONFIG_X86_KERNEL_IBT is not set
> +CONFIG_X86_KERNEL_IBT=y
> CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
> CONFIG_X86_INTEL_TSX_MODE_OFF=y
> # CONFIG_X86_INTEL_TSX_MODE_ON is not set
> diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
> index fb4ea3a6f..6d00654af 100644
> --- a/config/rootfiles/common/x86_64/linux
> +++ b/config/rootfiles/common/x86_64/linux
> @@ -11318,6 +11318,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER-ipfire/build/include/config/X86_INTERNODE_CACHE_SHIFT
> #lib/modules/KVER-ipfire/build/include/config/X86_IOPL_IOPERM
> #lib/modules/KVER-ipfire/build/include/config/X86_IO_APIC
> +#lib/modules/KVER-ipfire/build/include/config/X86_KERNEL_IBT
> #lib/modules/KVER-ipfire/build/include/config/X86_L1_CACHE_SHIFT
> #lib/modules/KVER-ipfire/build/include/config/X86_LOCAL_APIC
> #lib/modules/KVER-ipfire/build/include/config/X86_MCE
> -- 
> 2.35.3
diff mbox series

Patch

diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index 6c880ca8a..d70a19656 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -431,7 +431,7 @@  CONFIG_X86_PAT=y
 CONFIG_ARCH_USES_PG_UNCACHED=y
 CONFIG_X86_UMIP=y
 CONFIG_CC_HAS_IBT=y
-# CONFIG_X86_KERNEL_IBT is not set
+CONFIG_X86_KERNEL_IBT=y
 CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
 CONFIG_X86_INTEL_TSX_MODE_OFF=y
 # CONFIG_X86_INTEL_TSX_MODE_ON is not set
diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
index fb4ea3a6f..6d00654af 100644
--- a/config/rootfiles/common/x86_64/linux
+++ b/config/rootfiles/common/x86_64/linux
@@ -11318,6 +11318,7 @@  etc/modprobe.d/ipv6.conf
 #lib/modules/KVER-ipfire/build/include/config/X86_INTERNODE_CACHE_SHIFT
 #lib/modules/KVER-ipfire/build/include/config/X86_IOPL_IOPERM
 #lib/modules/KVER-ipfire/build/include/config/X86_IO_APIC
+#lib/modules/KVER-ipfire/build/include/config/X86_KERNEL_IBT
 #lib/modules/KVER-ipfire/build/include/config/X86_L1_CACHE_SHIFT
 #lib/modules/KVER-ipfire/build/include/config/X86_LOCAL_APIC
 #lib/modules/KVER-ipfire/build/include/config/X86_MCE