Merge branch 'scs-pac'

Refers to #131

Thanks @jvoisin

diff --combined kernel_hardening_checker/checks.py
index 7ac45b16ee72532aac4275fe530bc72fe85d07b9,672ea7e5df389cab8eedcc004e4587aa44d78cf7..d3d5a8338e534596c5f485f04f7b932f053f2ba6
--- 1/kernel_hardening_checker/checks.py
--- 2/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@@ -65,9 -65,11 +65,9 @@@ def add_kconfig_checks(l: List[Checklis
      if arch in ('X86_64', 'ARM64', 'ARM'):
          l += [vmap_stack_is_set]
      if arch in ('X86_64', 'X86_32'):
 -        l += [KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_WX', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'WERROR', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE', 'y')]
 -        l += [KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'SYN_COOKIES', 'y')] # another reason?
          microcode_is_set = KconfigCheck('self_protection', 'defconfig', 'MICROCODE', 'y')
          l += [microcode_is_set] # is needed for mitigating CPU bugs
@@@ -87,26 -89,16 +87,26 @@@
                   cpu_sup_intel_not_set)]
          l += [OR(KconfigCheck('self_protection', 'defconfig', 'X86_MCE_AMD', 'y'),
                   cpu_sup_amd_not_set)]
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'CPU_MITIGATIONS', 'y'),
 +                 KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y'))]
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RETPOLINE', 'y'),
 +                 KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y'))]
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RFDS', 'y'),
 +                 cpu_sup_intel_not_set)]
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SPECTRE_BHI', 'y'),
 +                 cpu_sup_intel_not_set)]
      if arch in ('ARM64', 'ARM'):
          l += [KconfigCheck('self_protection', 'defconfig', 'HW_RANDOM_TPM', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'IOMMU_DEFAULT_DMA_STRICT', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set')] # true if IOMMU_DEFAULT_DMA_STRICT is set
          l += [KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR_PER_TASK', 'y')]
      if arch == 'X86_64':
 -        l += [KconfigCheck('self_protection', 'defconfig', 'PAGE_TABLE_ISOLATION', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MEMORY', 'y')]
          l += [KconfigCheck('self_protection', 'defconfig', 'X86_KERNEL_IBT', 'y')]
 -        l += [OR(KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y'),
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_PAGE_TABLE_ISOLATION', 'y'),
 +                 KconfigCheck('self_protection', 'defconfig', 'PAGE_TABLE_ISOLATION', 'y'))]
 +        l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SRSO', 'y'),
 +                 KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y'),
                   cpu_sup_amd_not_set)]
          l += [AND(KconfigCheck('self_protection', 'defconfig', 'INTEL_IOMMU', 'y'),
                    iommu_support_is_set)]
@@@ -135,8 -127,6 +135,8 @@@
          l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_ALIGN_RODATA', 'y')]
  
      # 'self_protection', 'kspp'
 +    l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_CHECK', 'y')]
 +    l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_CHECK_ENFORCED', 'y')]
      l += [KconfigCheck('self_protection', 'kspp', 'BUG_ON_DATA_CORRUPTION', 'y')]
      l += [KconfigCheck('self_protection', 'kspp', 'SLAB_FREELIST_HARDENED', 'y')]
      l += [KconfigCheck('self_protection', 'kspp', 'SLAB_FREELIST_RANDOM', 'y')]
@@@ -244,8 -234,7 +244,8 @@@
          l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '32768')]
          l += [KconfigCheck('self_protection', 'kspp', 'SYN_COOKIES', 'y')] # another reason?
      if arch == 'X86_64':
 -        l += [KconfigCheck('self_protection', 'kspp', 'SLS', 'y')] # vs CVE-2021-26341 in Straight-Line-Speculation
 +        l += [OR(KconfigCheck('self_protection', 'kspp', 'MITIGATION_SLS', 'y'),
 +                 KconfigCheck('self_protection', 'kspp', 'SLS', 'y'))] # vs CVE-2021-26341 in Straight-Line-Speculation
          l += [AND(KconfigCheck('self_protection', 'kspp', 'INTEL_IOMMU_SVM', 'y'),
                    iommu_support_is_set)]
          l += [AND(KconfigCheck('self_protection', 'kspp', 'AMD_IOMMU_V2', 'y'),
@@@ -253,12 -242,12 +253,13 @@@
      if arch == 'ARM64':
          l += [KconfigCheck('self_protection', 'kspp', 'ARM64_SW_TTBR0_PAN', 'y')]
          l += [KconfigCheck('self_protection', 'kspp', 'SHADOW_CALL_STACK', 'y')]
+         l += [KconfigCheck('self_protection', 'kspp', 'UNWIND_PATCH_PAC_INTO_SCS', 'y')]
          l += [KconfigCheck('self_protection', 'kspp', 'KASAN_HW_TAGS', 'y')] # see also: kasan=on, kasan.stacktrace=off, kasan.fault=panic
      if arch == 'X86_32':
 -        l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y')]
          l += [KconfigCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')]
          l += [KconfigCheck('self_protection', 'kspp', 'X86_PAE', 'y')]
 +        l += [OR(KconfigCheck('self_protection', 'kspp', 'MITIGATION_PAGE_TABLE_ISOLATION', 'y'),
 +                 KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y'))]
          l += [AND(KconfigCheck('self_protection', 'kspp', 'INTEL_IOMMU', 'y'),
                    iommu_support_is_set)]
  
@@@ -477,10 -466,6 +478,10 @@@ def add_cmdline_checks(l: List[Checklis
          l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'),
                   AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
                       CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set')))]
 +        l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_bhi', 'is not off'),
 +                 AND(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SPECTRE_BHI', 'y'),
 +                     CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
 +                     CmdlineCheck('self_protection', 'defconfig', 'spectre_bhi', 'is not set')))]
          l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'),
                   AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
                       CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set')))]
@@@ -508,10 -493,6 +509,10 @@@
          l += [OR(CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not off'),
                   AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
                       CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not set')))]
 +        l += [OR(CmdlineCheck('self_protection', 'defconfig', 'reg_file_data_sampling', 'is not off'),
 +                 AND(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RFDS', 'y'),
 +                     CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
 +                     CmdlineCheck('self_protection', 'defconfig', 'reg_file_data_sampling', 'is not set')))]
      if arch == 'ARM64':
          l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'),
                   AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
@@@ -631,7 -612,6 +632,7 @@@ no_kstrtobool_options = 
      'pti', # See pti_check_boottime_disable() in arch/x86/mm/pti.c
      'spectre_v2', # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
      'spectre_v2_user', # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
 +    'spectre_bhi', # See spectre_bhi_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
      'spec_store_bypass_disable', # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
      'l1tf', # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
      'mds', # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
@@@ -643,7 -623,6 +644,7 @@@
      'ssbd', # See parse_spectre_v4_param() in arch/arm64/kernel/proton-pack.c
      'spec_rstack_overflow', # See srso_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
      'gather_data_sampling', # See gds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
 +    'reg_file_data_sampling', # See rfds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
      'slub_debug', # See setup_slub_debug() in mm/slub.c
      'iommu', # See iommu_setup() in arch/x86/kernel/pci-dma.c
      'vsyscall', # See vsyscall_setup() in arch/x86/entry/vsyscall/vsyscall_64.c