From ae2ba5a770964b46606a6016c4f558b8edc6e7f3 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 3 Jun 2019 20:27:51 +0300 Subject: [PATCH] Add my recommendations for AMD (similar to CLIP OS recommendations for Intel) Refers to the issue #19 by @HacKurx --- kconfig-hardened-check.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 962e120..777f8db 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -256,6 +256,11 @@ def construct_checklist(arch): checklist.append(AND(OptCheck('INTEL_IOMMU_DEFAULT_ON', 'y', 'clipos', 'self_protection'), \ iommu_support_is_set)) + if debug_mode or arch == 'X86_64': + checklist.append(AND(OptCheck('AMD_IOMMU', 'y', 'my', 'self_protection'), \ + iommu_support_is_set)) + checklist.append(AND(OptCheck('AMD_IOMMU_V2', 'y', 'my', 'self_protection'), \ + iommu_support_is_set)) if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32': stackleak_is_set = OptCheck('GCC_PLUGIN_STACKLEAK', 'y', 'my', 'self_protection') checklist.append(stackleak_is_set) -- 2.31.1