From 317a089b83ae5ccbb25ff9eff67d1fff46e7f6f2 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Fri, 29 Nov 2019 00:11:07 +0300 Subject: [PATCH] x86_32: INTEL_IOMMU is not enabled by default - fix the reason --- kconfig-hardened-check.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index d7da0fd..2973a0a 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -195,12 +195,12 @@ def construct_checklist(checklist, arch): OptCheck('X86_INTEL_UMIP', 'y', 'defconfig', 'self_protection'))) iommu_support_is_set = OptCheck('IOMMU_SUPPORT', 'y', 'defconfig', 'self_protection') # is needed for mitigating DMA attacks checklist.append(iommu_support_is_set) - checklist.append(AND(OptCheck('INTEL_IOMMU', 'y', 'defconfig', 'self_protection'), \ - iommu_support_is_set)) checklist.append(OptCheck('SYN_COOKIES', 'y', 'defconfig', 'self_protection')) # another reason? if debug_mode or arch == 'X86_64': checklist.append(OptCheck('PAGE_TABLE_ISOLATION', 'y', 'defconfig', 'self_protection')) checklist.append(OptCheck('RANDOMIZE_MEMORY', 'y', 'defconfig', 'self_protection')) + checklist.append(AND(OptCheck('INTEL_IOMMU', 'y', 'defconfig', 'self_protection'), \ + iommu_support_is_set)) checklist.append(AND(OptCheck('AMD_IOMMU', 'y', 'defconfig', 'self_protection'), \ iommu_support_is_set)) if debug_mode or arch == 'ARM64': -- 2.31.1