From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH] kernel: enable CONFIG_X86_INTEL_UMIP on x86_64 Date: Tue, 09 Jun 2020 17:30:39 +0000 Message-ID: <6eb7b950-49e4-531f-a8ff-fa97470bd141@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7042254506557407845==" List-Id: --===============7042254506557407845== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Quoted from https://capsule8.com/blog/kernel-configuration-glossary/: > Significance: High > > The User Mode Instruction Prevention (UMIP) is a security feature in newer > Intel processors. If enabled a general protection fault is issued if the SG= DT > SLDT SIDT SMSW or STR instructions are executed in user mode. These > instructions unnecessarily expose information about the hardware state. Personally, I do not like Intel's "hardware security features" as they often turned out as being difficult to handle, to implement and completely useless or even contraproductive at the end of the day (SGX? Why, did anyone mentioned SGX?!). Anyway, here we go... Fixes: #12367 Cc: Arne Fitzenreiter Cc: Michael Tremer Signed-off-by: Peter M=C3=BCller --- config/kernel/kernel.config.x86_64-ipfire | 1 + 1 file changed, 1 insertion(+) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel= .config.x86_64-ipfire index 6a5fbbfe9..f37b4b5d4 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -459,6 +459,7 @@ CONFIG_X86_EXTENDED_PLATFORM=3Dy # CONFIG_X86_GOLDFISH is not set # CONFIG_X86_INTEL_MID is not set CONFIG_X86_INTEL_LPSS=3Dy +CONFIG_X86_INTEL_UMIP=3Dy CONFIG_X86_AMD_PLATFORM_DEVICE=3Dy CONFIG_IOSF_MBI=3Dy # CONFIG_IOSF_MBI_DEBUG is not set --=20 2.26.2 --===============7042254506557407845==--