[PATCH 1/3] linux: Enable Indirect Branch Tracking by default

[PATCH 1/3] linux: Enable Indirect Branch Tracking by default

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 1667 bytes --]

This became upstream default (see
https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media
coverage), and given its security-relevance, we should adopt this
setting as well.

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 config/kernel/kernel.config.x86_64-ipfire | 2 +-
 config/rootfiles/common/x86_64/linux      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index 6c880ca8a..d70a19656 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -431,7 +431,7 @@ CONFIG_X86_PAT=y
 CONFIG_ARCH_USES_PG_UNCACHED=y
 CONFIG_X86_UMIP=y
 CONFIG_CC_HAS_IBT=y
-# CONFIG_X86_KERNEL_IBT is not set
+CONFIG_X86_KERNEL_IBT=y
 CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
 CONFIG_X86_INTEL_TSX_MODE_OFF=y
 # CONFIG_X86_INTEL_TSX_MODE_ON is not set
diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
index fb4ea3a6f..6d00654af 100644
--- a/config/rootfiles/common/x86_64/linux
+++ b/config/rootfiles/common/x86_64/linux
@@ -11318,6 +11318,7 @@ etc/modprobe.d/ipv6.conf
 #lib/modules/KVER-ipfire/build/include/config/X86_INTERNODE_CACHE_SHIFT
 #lib/modules/KVER-ipfire/build/include/config/X86_IOPL_IOPERM
 #lib/modules/KVER-ipfire/build/include/config/X86_IO_APIC
+#lib/modules/KVER-ipfire/build/include/config/X86_KERNEL_IBT
 #lib/modules/KVER-ipfire/build/include/config/X86_L1_CACHE_SHIFT
 #lib/modules/KVER-ipfire/build/include/config/X86_LOCAL_APIC
 #lib/modules/KVER-ipfire/build/include/config/X86_MCE
-- 
2.35.3

[PATCH 2/3] linux: Trigger a BUG() when corruption of kernel data structures is detected

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 2346 bytes --]

Given that this will merely log such an incident, this can be safely
enabled.

Cc: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire | 4 ++--
 config/kernel/kernel.config.riscv64-ipfire | 4 ++--
 config/kernel/kernel.config.x86_64-ipfire  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index c78902e76..a85704e96 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -8584,11 +8584,11 @@ CONFIG_STACKTRACE=y
 #
 # Debug kernel data structures
 #
-# CONFIG_DEBUG_LIST is not set
+CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_PLIST is not set
 # CONFIG_DEBUG_SG is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
-# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 # CONFIG_DEBUG_MAPLE_TREE is not set
 # end of Debug kernel data structures
 
diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
index a0c6f2e31..4693aff9c 100644
--- a/config/kernel/kernel.config.riscv64-ipfire
+++ b/config/kernel/kernel.config.riscv64-ipfire
@@ -7072,11 +7072,11 @@ CONFIG_STACKTRACE=y
 #
 # Debug kernel data structures
 #
-# CONFIG_DEBUG_LIST is not set
+CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_PLIST is not set
 # CONFIG_DEBUG_SG is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
-# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 # CONFIG_DEBUG_MAPLE_TREE is not set
 # end of Debug kernel data structures
 
diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index d70a19656..0ed32f101 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -7760,11 +7760,11 @@ CONFIG_STACKTRACE=y
 #
 # Debug kernel data structures
 #
-# CONFIG_DEBUG_LIST is not set
+CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_PLIST is not set
 # CONFIG_DEBUG_SG is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
-# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+CONFIG_BUG_ON_DATA_CORRUPTION=y
 # CONFIG_DEBUG_MAPLE_TREE is not set
 # end of Debug kernel data structures
 
-- 
2.35.3

[PATCH 3/3] linux: Align default IOMMU handling on aarch64

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 1024 bytes --]

Resorting to strict default IOMMU handling has been our default for
several Core Updates on x86_64 by now, so bring this security
improvement to our aarch64 userbase as well.

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index a85704e96..dec736a56 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -7257,9 +7257,9 @@ CONFIG_IOMMU_IO_PGTABLE_LPAE=y
 # CONFIG_IOMMU_IO_PGTABLE_DART is not set
 # end of Generic IOMMU Pagetable Support
 
-# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set
+CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
 # CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
-CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
+# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
 CONFIG_OF_IOMMU=y
 CONFIG_IOMMU_DMA=y
 CONFIG_ROCKCHIP_IOMMU=y
-- 
2.35.3

Re: [PATCH 1/3] linux: Enable Indirect Branch Tracking by default

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 2175 bytes --]

Hello Peter,

I am happy with this going in, but we should also enable this in user space, too.

I will take care of this and post a patch soon. I don’t think all fits into one update, so I believe we should release this and follow up with the user space whenever suitable.

Best,
-Michael

Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 9 Jul 2023, at 15:55, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> This became upstream default (see
> https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media
> coverage), and given its security-relevance, we should adopt this
> setting as well.
> 
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
> config/kernel/kernel.config.x86_64-ipfire | 2 +-
> config/rootfiles/common/x86_64/linux      | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index 6c880ca8a..d70a19656 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -431,7 +431,7 @@ CONFIG_X86_PAT=y
> CONFIG_ARCH_USES_PG_UNCACHED=y
> CONFIG_X86_UMIP=y
> CONFIG_CC_HAS_IBT=y
> -# CONFIG_X86_KERNEL_IBT is not set
> +CONFIG_X86_KERNEL_IBT=y
> CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
> CONFIG_X86_INTEL_TSX_MODE_OFF=y
> # CONFIG_X86_INTEL_TSX_MODE_ON is not set
> diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
> index fb4ea3a6f..6d00654af 100644
> --- a/config/rootfiles/common/x86_64/linux
> +++ b/config/rootfiles/common/x86_64/linux
> @@ -11318,6 +11318,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER-ipfire/build/include/config/X86_INTERNODE_CACHE_SHIFT
> #lib/modules/KVER-ipfire/build/include/config/X86_IOPL_IOPERM
> #lib/modules/KVER-ipfire/build/include/config/X86_IO_APIC
> +#lib/modules/KVER-ipfire/build/include/config/X86_KERNEL_IBT
> #lib/modules/KVER-ipfire/build/include/config/X86_L1_CACHE_SHIFT
> #lib/modules/KVER-ipfire/build/include/config/X86_LOCAL_APIC
> #lib/modules/KVER-ipfire/build/include/config/X86_MCE
> -- 
> 2.35.3