+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'),
+ AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'),
+ CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'),
+ AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'),
+ CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))]
+ # The cmdline checks compatible with the kconfig recommendations of the KSPP project...
+ l += [CmdlineCheck('self_protection', 'kspp', 'nokaslr', 'is not set')]
+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', '1'),
+ AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY', 'y'),
+ CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', '0'),
+ AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'),
+ CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', 'is not set')))]
+ if arch in ('X86_64', 'X86_32'):
+ l += [AND(CmdlineCheck('self_protection', 'kspp', 'pti', 'on'),
+ CmdlineCheck('self_protection', 'kspp', 'nopti', 'is not set'))] # ... the end