Changes and New Features
Info
For an archive of changes and features from previous releases, please refer to "Change Log History".
- Extended Arm-UEFI support to ensure seamless operation until BlueField BMC initialization completes
- Added RTC battery voltage monitoring to the SDR list for enhanced system diagnostics
- Implemented Redfish mutual authentication support for BlueField-3 platforms
- Updated BMC FRU content to enhance backward compatibility
Added BMC Redfish support for remote attestation over Redfish specifically for SPDM:
- BlueField NIC
- CEC1736 (BMC ERoT)
- Added support for the sensors
ddr_tempandrtc_voltageunder "BMC Sensor Data" Security Hardening: Implemented several Linux kernel configuration changes to improve system security and activated kernel module signature. The following table summarizes key modifications:
Parameter Old Value New Value Reason CONFIG_KEXECyesNot set Enables replacement of running kernel using kexeccommand.CONFIG_SLAB_MERGE_DEFAULTyesNot set Prevents merging similar-sized slab caches, mitigating cross-slab heap attacks CONFIG_SHUFFLE_PAGE_ALLOCATORNot set yesEnables randomization of the high-order page allocation freelist CONFIG_SECURITY_DMESG_RESTRICTNot set yesPrevents kernel memory address leakage through dmesgCONFIG_DEBUG_FSyesNot set Disables debugfs, reducing the kernel’s attack surfaceCONFIG_BPF_SYSCALLyesNot set Disables the bpf()syscall, restricting manipulation of BPF programs and mapsCONFIG_USER_NSyesNot set Disables user namespaces to prevent privilege escalation via namespace exploits CONFIG_BUG_ON_DATA_CORRUPTIONNot set yesEnables kernel validation checks for detecting data corruption CONFIG_DEFAULT_MMAP_MIN_ADDR409632768Increases the minimum mmap address to mitigate kernel NULL pointer dereference exploits CONFIG_DEBUG_KMEMLEAKyesNot set Disabled due to its dependency on
CONFIG_DEBUG_FS, which is also now disabledThis parameter changed only in BlueField-2 (already not set in BlueField-3).
InfoChanges to the kernel configuration parameters were made in accordance with recommended security hardening practices from the Linux Kernel Self-Protection Project (KSPP), grsecurity and CLIP OS.