projects
/
kconfig-hardened-check.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Add the 'spectre_v2' check
[kconfig-hardened-check.git]
/
kconfig_hardened_check
/
__init__.py
diff --git
a/kconfig_hardened_check/__init__.py
b/kconfig_hardened_check/__init__.py
index 1d74ee55d26c68f7427419812e67bf19711e9358..e6d84edaafd5643bcf613e8c72fba401780e1ca8 100644
(file)
--- a/
kconfig_hardened_check/__init__.py
+++ b/
kconfig_hardened_check/__init__.py
@@
-18,7
+18,6
@@
# Аrch-independent:
# mitigations=auto,nosmt (nosmt is slow)
# X86:
# Аrch-independent:
# mitigations=auto,nosmt (nosmt is slow)
# X86:
-# spectre_v2=on
# spec_store_bypass_disable=on
# l1tf=full,force
# l1d_flush=on (a part of the l1tf option)
# spec_store_bypass_disable=on
# l1tf=full,force
# l1d_flush=on (a part of the l1tf option)
@@
-747,7
+746,8
@@
def add_cmdline_checks(l, arch):
# 'self_protection', 'clipos'
l += [CmdlineCheck('self_protection', 'clipos', 'page_alloc.shuffle', '1')]
# 'self_protection', 'clipos'
l += [CmdlineCheck('self_protection', 'clipos', 'page_alloc.shuffle', '1')]
-
+ if arch in ('X86_64', 'X86_32'):
+ l += [CmdlineCheck('self_protection', 'clipos', 'spectre_v2', 'on')]
# 'cut_attack_surface', 'kspp'
if arch == 'X86_64':
# 'cut_attack_surface', 'kspp'
if arch == 'X86_64':
@@
-907,6
+907,9
@@
def normalize_cmdline_options(option, value):
if option == 'pti':
# See pti_check_boottime_disable() in linux/arch/x86/mm/pti.c
return value
if option == 'pti':
# See pti_check_boottime_disable() in linux/arch/x86/mm/pti.c
return value
+ if option == 'spectre_v2':
+ # See spectre_v2_parse_cmdline() in linux/arch/x86/kernel/cpu/bugs.c
+ return value
if option == 'debugfs':
# See debugfs_kernel() in fs/debugfs/inode.c
return value
if option == 'debugfs':
# See debugfs_kernel() in fs/debugfs/inode.c
return value