From 6ee763d040dc0988da257b19ad8c88d2ab9328cc Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Fri, 11 Nov 2022 17:39:19 +0300 Subject: [PATCH] Add the 'mitigations' check The default value for the 'mitigations' option is 'auto'. So this option should be enabled ('is not off') or not set at all. --- kconfig_hardened_check/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index c226cc9..3ac7aa7 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -15,7 +15,6 @@ # # Mitigations of CPU vulnerabilities: # Аrch-independent: -# mitigations=auto,nosmt (nosmt is slow) # X86: # spec_store_bypass_disable=on # l1tf=full,force @@ -736,6 +735,8 @@ def add_cmdline_checks(l, arch): l += [CmdlineCheck('self_protection', 'defconfig', 'nopti', 'is not set')] l += [CmdlineCheck('self_protection', 'defconfig', 'nospectre_v1', 'is not set')] l += [CmdlineCheck('self_protection', 'defconfig', 'nospectre_v2', 'is not set')] + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not off'), + CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not set'))] if arch == 'ARM64': l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'), AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'), @@ -950,6 +951,9 @@ def normalize_cmdline_options(option, value): if option == 'debugfs': # See debugfs_kernel() in fs/debugfs/inode.c return value + if option == 'mitigations': + # See mitigations_parse_cmdline() in linux/kernel/cpu.c + return value # Implement a limited part of the kstrtobool() logic if value in ('1', 'on', 'On', 'ON', 'y', 'Y', 'yes', 'Yes', 'YES'): -- 2.31.1