Commit 225f2bd0 authored by Breno Leitao's avatar Breno Leitao Committed by Borislav Petkov (AMD)
Browse files

x86/bugs: Add a separate config for GDS 



Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated, where some
mitigations have entries in Kconfig, and they could be modified, while others
mitigations do not have Kconfig entries, and could not be controlled at build
time.

Create a new kernel config that allows GDS to be completely disabled,
similarly to the "gather_data_sampling=off" or "mitigations=off" kernel
command-line.

Now, there are two options for GDS mitigation:

* CONFIG_MITIGATION_GDS=n -> Mitigation disabled (New)
* CONFIG_MITIGATION_GDS=y -> Mitigation enabled (GDS_MITIGATION_FULL)

Suggested-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Acked-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20240729164105.554296-12-leitao@debian.org
parent 03267a53

arch/x86/Kconfig

+10 −0
Original line number Diff line number Diff line
@@ -2610,6 +2610,16 @@ config MITIGATION_SLS 
	  against straight line speculation. The kernel image might be slightly

	  larger.



config MITIGATION_GDS

	bool "Mitigate Gather Data Sampling"

	depends on CPU_SUP_INTEL

	default y

	help

	  Enable mitigation for Gather Data Sampling (GDS). GDS is a hardware

	  vulnerability which allows unprivileged speculative access to data

	  which was previously stored in vector registers. The attacker uses gather

	  instructions to infer the stale vector register data.



config MITIGATION_RFDS

	bool "RFDS Mitigation"

	depends on CPU_SUP_INTEL

arch/x86/kernel/cpu/bugs.c

+2 −1
Original line number Diff line number Diff line
@@ -735,7 +735,8 @@ enum gds_mitigations { 
	GDS_MITIGATION_HYPERVISOR,

};



static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;

static enum gds_mitigations gds_mitigation __ro_after_init =

	IS_ENABLED(CONFIG_MITIGATION_GDS) ? GDS_MITIGATION_FULL : GDS_MITIGATION_OFF;



static const char * const gds_strings[] = {

	[GDS_MITIGATION_OFF]		= "Vulnerable",