kevin/linux
1
Fork 0
Code

x86/bugs: Add a separate config for GDS

Browse Source 
Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated, where some
mitigations have entries in Kconfig, and they could be modified, while others
mitigations do not have Kconfig entries, and could not be controlled at build
time.

Create a new kernel config that allows GDS to be completely disabled,
similarly to the "gather_data_sampling=off" or "mitigations=off" kernel
command-line.

Now, there are two options for GDS mitigation:

* CONFIG_MITIGATION_GDS=n -> Mitigation disabled (New)
* CONFIG_MITIGATION_GDS=y -> Mitigation enabled (GDS_MITIGATION_FULL)

Suggested-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20240729164105.554296-12-leitao@debian.org
This commit is contained in:
Breno Leitao 2024-07-29 09:40:59 -07:00 committed by Borislav Petkov (AMD)
parent 03267a534b
commit 225f2bd064
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
arch/x86/Kconfig
View File

@ -2610,6 +2610,16 @@ config MITIGATION_SLS
against straight line speculation. The kernel image might be slightly
larger.
config MITIGATION_GDS
bool "Mitigate Gather Data Sampling"
depends on CPU_SUP_INTEL
default y
help
Enable mitigation for Gather Data Sampling (GDS). GDS is a hardware
vulnerability which allows unprivileged speculative access to data
which was previously stored in vector registers. The attacker uses gather
instructions to infer the stale vector register data.
config MITIGATION_RFDS
bool "RFDS Mitigation"
depends on CPU_SUP_INTEL

3
arch/x86/kernel/cpu/bugs.c
View File

@ -735,7 +735,8 @@ enum gds_mitigations {
GDS_MITIGATION_HYPERVISOR,
};
static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;
static enum gds_mitigations gds_mitigation __ro_after_init =
IS_ENABLED(CONFIG_MITIGATION_GDS) ? GDS_MITIGATION_FULL : GDS_MITIGATION_OFF;
static const char * const gds_strings[] = {
[GDS_MITIGATION_OFF] = "Vulnerable",