From: Alexander Popov <alex.popov@linux.com>
Date: Tue, 24 Mar 2020 12:10:37 +0000 (+0300)
Subject: CLIP OS recommends disabling Intel TSX
X-Git-Tag: v0.5.5~2
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=e2ed77e8af4fe965c0d3eb7aef64412ce55ef0f6;p=kconfig-hardened-check.git

CLIP OS recommends disabling Intel TSX
---

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index b24918a..5df4997 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -29,6 +29,7 @@
 #           spec_store_bypass_disable=on
 #           l1tf=full,force
 #           mds=full,nosmt
+#           tsx=off
 #       ARM64:
 #           kpti=on
 #           ssbd=force-on
@@ -419,6 +420,8 @@ def construct_checklist(checklist, arch):
     checklist.append(OptCheck('BPF_SYSCALL',          'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCKDOWN
     checklist.append(OptCheck('MMIOTRACE_TEST',       'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCKDOWN
 
+    if arch == 'X86_64' or arch == 'X86_32':
+        checklist.append(OptCheck('X86_INTEL_TSX_MODE_OFF',   'y', 'clipos', 'cut_attack_surface')) # tsx=off
     checklist.append(OptCheck('STAGING',                  'is not set', 'clipos', 'cut_attack_surface'))
     checklist.append(OptCheck('KSM',                      'is not set', 'clipos', 'cut_attack_surface')) # to prevent FLUSH+RELOAD attack
 #   checklist.append(OptCheck('IKCONFIG',                 'is not set', 'clipos', 'cut_attack_surface')) # no, this info is needed for this check :)