Commit 03267a53 authored by Breno Leitao's avatar Breno Leitao Committed by Borislav Petkov (AMD)
Browse files

x86/bugs: Remove GDS Force Kconfig option 



Remove the MITIGATION_GDS_FORCE Kconfig option, which aggressively disables
AVX as a mitigation for Gather Data Sampling (GDS) vulnerabilities. This
option is not widely used by distros.

While removing the Kconfig option, retain the runtime configuration ability
through the `gather_data_sampling=force` kernel parameter. This allows users
to still enable this aggressive mitigation if needed, without baking it into
the kernel configuration.

Simplify the kernel configuration while maintaining flexibility for runtime
mitigation choices.

Suggested-by: default avatarBorislav Petkov <bp@alien8.de>
Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarDaniel Sneddon <daniel.sneddon@linux.intel.com>
Link: https://lore.kernel.org/r/20240729164105.554296-11-leitao@debian.org
parent b908cdab

arch/x86/Kconfig

+0 −19
Original line number Diff line number Diff line
@@ -2610,25 +2610,6 @@ config MITIGATION_SLS 
	  against straight line speculation. The kernel image might be slightly

	  larger.



config MITIGATION_GDS_FORCE

	bool "Force GDS Mitigation"

	depends on CPU_SUP_INTEL

	default n

	help

	  Gather Data Sampling (GDS) is a hardware vulnerability which allows

	  unprivileged speculative access to data which was previously stored in

	  vector registers.



	  This option is equivalent to setting gather_data_sampling=force on the

	  command line. The microcode mitigation is used if present, otherwise

	  AVX is disabled as a mitigation. On affected systems that are missing

	  the microcode any userspace code that unconditionally uses AVX will

	  break with this option set.



	  Setting this option on systems not vulnerable to GDS has no effect.



	  If in doubt, say N.



config MITIGATION_RFDS

	bool "RFDS Mitigation"

	depends on CPU_SUP_INTEL

arch/x86/kernel/cpu/bugs.c

+0 −4
Original line number Diff line number Diff line
@@ -735,11 +735,7 @@ enum gds_mitigations { 
	GDS_MITIGATION_HYPERVISOR,

};



#if IS_ENABLED(CONFIG_MITIGATION_GDS_FORCE)

static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE;

#else

static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;

#endif



static const char * const gds_strings[] = {

	[GDS_MITIGATION_OFF]		= "Vulnerable",