The default value for the 'mitigations' option is 'auto'.

So this option should be enabled ('is not off') or not set at all.

This check gives FAIL if the option value is 'off' or
the option is not found. In other cases this check gives OK.

This feature is needed for checking that the CPU vulnerability mitigations
are not disabled. Let's see how it works and maybe improve it in future.

Thanks to @kees

Thanks to @kees

Thanks to @kees

Thanks to @kees

Thanks to @kees

Clip OS says that RANDOM_TRUST_BOOTLOADER and RANDOM_TRUST_CPU should be
disabled if HW_RANDOM_TPM is enabled. The Clip OS description:
  Do not credit entropy included in Linux’s entropy pool when generated
  by the CPU manufacturer’s HWRNG, the bootloader or the UEFI firmware.
  Fast and robust initialization of Linux’s CSPRNG is instead achieved
  thanks to the TPM’s HWRNG.

At the same time KSPP recommends to enable RANDOM_TRUST_BOOTLOADER and
RANDOM_TRUST_CPU anyway:
  Get as much entropy as possible from external sources. The Chacha mixer
  isn't vulnerable to injected entropy, so even malicious sources
  should not cause problems.

In this situation, I think kconfig-hardened-check should check
only HW_RANDOM_TPM (there is no contradiction about it)
and leave the decision about RANDOM_TRUST_BOOTLOADER and
RANDOM_TRUST_CPU to the owner of the system.

Thanks to @kees

Thanks to @kees

Clip OS description: it "will eventually be n".

RANDOM_TRUST_BOOTLOADER and RANDOM_TRUST_CPU should be disabled if
HW_RANDOM_TPM is enabled.

The Clip OS description:
Do not credit entropy included in Linux’s entropy pool when generated
by the CPU manufacturer’s HWRNG, the bootloader or the UEFI firmware.
Fast and robust initialization of Linux’s CSPRNG is instead achieved
thanks to the TPM’s HWRNG.

Disabling COREDUMP is needed for cutting userspace attack surface.

These options are enabled by default.

KASLR is enabled by default.

Don't normalize this cmdline option.

SMEP and SMAP are enabled by default.

Explanations from the Linux kernel commit 6a6155f664e31c9be43cd:

When the kernel is compiled with Clang, -fsanitize=bounds expands to
-fsanitize=array-bounds and -fsanitize=local-bounds.

Enabling -fsanitize=local-bounds with Clang has the side-effect of
inserting traps.

That's why UBSAN_LOCAL_BOUNDS can enable the 'local-bounds' option
only when UBSAN_TRAP is enabled.

Android Open Source Project (AOSP):
https://source.android.com/docs/setup/build/building-kernels

Android Generic Kernel Image (GKI):
https://source.android.com/docs/core/architecture/kernel/gki-release-builds

Also add the GKI config `android13-5.10`.

Thanks to @h0t for the idea.