From: Alexander Popov Date: Mon, 11 Jul 2022 06:59:26 +0000 (+0300) Subject: Add iommu.passthrough check X-Git-Tag: v0.6.1~126 X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=b6930eaede680a77a8ff4c2a8c2b4ae33c9aa12e;p=kconfig-hardened-check.git Add iommu.passthrough check --- diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 28a661c..0d6a470 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -13,7 +13,6 @@ # N.B Hardening command line parameters: # page_alloc.shuffle=1 # iommu=force (does it help against DMA attacks?) -# iommu.passthrough=0 # slub_debug=FZ (slow) # loadpin.enforce=1 # debugfs=no-mount (or off if possible) @@ -662,6 +661,9 @@ def add_cmdline_checks(l, arch): l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'), AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'), CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'), + AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))] if arch in ('X86_64', 'ARM64', 'X86_32'): l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'), AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'),