From: Alexander Popov <alex.popov@linux.com>
Date: Thu, 28 Nov 2019 21:11:07 +0000 (+0300)
Subject: x86_32: INTEL_IOMMU is not enabled by default - fix the reason
X-Git-Tag: v0.5.3~5
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=317a089b83ae5ccbb25ff9eff67d1fff46e7f6f2;p=kconfig-hardened-check.git

x86_32: INTEL_IOMMU is not enabled by default - fix the reason
---

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index d7da0fd..2973a0a 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -195,12 +195,12 @@ def construct_checklist(checklist, arch):
                             OptCheck('X86_INTEL_UMIP',           'y', 'defconfig', 'self_protection')))
         iommu_support_is_set = OptCheck('IOMMU_SUPPORT',         'y', 'defconfig', 'self_protection') # is needed for mitigating DMA attacks
         checklist.append(iommu_support_is_set)
-        checklist.append(AND(OptCheck('INTEL_IOMMU',             'y', 'defconfig', 'self_protection'), \
-                             iommu_support_is_set))
         checklist.append(OptCheck('SYN_COOKIES',                 'y', 'defconfig', 'self_protection')) # another reason?
     if debug_mode or arch == 'X86_64':
         checklist.append(OptCheck('PAGE_TABLE_ISOLATION',        'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('RANDOMIZE_MEMORY',            'y', 'defconfig', 'self_protection'))
+        checklist.append(AND(OptCheck('INTEL_IOMMU',             'y', 'defconfig', 'self_protection'), \
+                             iommu_support_is_set))
         checklist.append(AND(OptCheck('AMD_IOMMU',               'y', 'defconfig', 'self_protection'), \
                              iommu_support_is_set))
     if debug_mode or arch == 'ARM64':