Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

x86/bugs: Remove GDS Force Kconfig option

Remove the MITIGATION_GDS_FORCE Kconfig option, which aggressively disables
AVX as a mitigation for Gather Data Sampling (GDS) vulnerabilities. This
option is not widely used by distros.

While removing the Kconfig option, retain the runtime configuration ability
through the `gather_data_sampling=force` kernel parameter. This allows users
to still enable this aggressive mitigation if needed, without baking it into
the kernel configuration.

Simplify the kernel configuration while maintaining flexibility for runtime
mitigation choices.

Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Link: https://lore.kernel.org/r/20240729164105.554296-11-leitao@debian.org

authored by

Breno Leitao and committed by
Borislav Petkov (AMD)
03267a53 b908cdab

-23
-19
arch/x86/Kconfig
··· 2610 2610 against straight line speculation. The kernel image might be slightly 2611 2611 larger. 2612 2612 2613 - config MITIGATION_GDS_FORCE 2614 - bool "Force GDS Mitigation" 2615 - depends on CPU_SUP_INTEL 2616 - default n 2617 - help 2618 - Gather Data Sampling (GDS) is a hardware vulnerability which allows 2619 - unprivileged speculative access to data which was previously stored in 2620 - vector registers. 2621 - 2622 - This option is equivalent to setting gather_data_sampling=force on the 2623 - command line. The microcode mitigation is used if present, otherwise 2624 - AVX is disabled as a mitigation. On affected systems that are missing 2625 - the microcode any userspace code that unconditionally uses AVX will 2626 - break with this option set. 2627 - 2628 - Setting this option on systems not vulnerable to GDS has no effect. 2629 - 2630 - If in doubt, say N. 2631 - 2632 2613 config MITIGATION_RFDS 2633 2614 bool "RFDS Mitigation" 2634 2615 depends on CPU_SUP_INTEL
-4
arch/x86/kernel/cpu/bugs.c
··· 735 735 GDS_MITIGATION_HYPERVISOR, 736 736 }; 737 737 738 - #if IS_ENABLED(CONFIG_MITIGATION_GDS_FORCE) 739 - static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE; 740 - #else 741 738 static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL; 742 - #endif 743 739 744 740 static const char * const gds_strings[] = { 745 741 [GDS_MITIGATION_OFF] = "Vulnerable",