diff options
| author | Breno Leitao <leitao@debian.org> | 2024-07-29 09:40:58 -0700 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2024-07-30 14:53:15 +0200 |
| commit | 03267a534bb388acdd2ee685101084d144e8384c (patch) | |
| tree | ffce936a950256810668658d5a4fff9f2af256fe /arch/x86/Kconfig | |
| parent | b908cdab061a5ead51d5e1731ca9c1b26699a9bb (diff) | |
x86/bugs: Remove GDS Force Kconfig option
Remove the MITIGATION_GDS_FORCE Kconfig option, which aggressively disables
AVX as a mitigation for Gather Data Sampling (GDS) vulnerabilities. This
option is not widely used by distros.
While removing the Kconfig option, retain the runtime configuration ability
through the `gather_data_sampling=force` kernel parameter. This allows users
to still enable this aggressive mitigation if needed, without baking it into
the kernel configuration.
Simplify the kernel configuration while maintaining flexibility for runtime
mitigation choices.
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Link: https://lore.kernel.org/r/20240729164105.554296-11-leitao@debian.org
Diffstat (limited to 'arch/x86/Kconfig')
| -rw-r--r-- | arch/x86/Kconfig | 19 |
1 files changed, 0 insertions, 19 deletions
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 2e72a07981b2..ab5b210c8315 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2610,25 +2610,6 @@ config MITIGATION_SLS against straight line speculation. The kernel image might be slightly larger. -config MITIGATION_GDS_FORCE - bool "Force GDS Mitigation" - depends on CPU_SUP_INTEL - default n - help - Gather Data Sampling (GDS) is a hardware vulnerability which allows - unprivileged speculative access to data which was previously stored in - vector registers. - - This option is equivalent to setting gather_data_sampling=force on the - command line. The microcode mitigation is used if present, otherwise - AVX is disabled as a mitigation. On affected systems that are missing - the microcode any userspace code that unconditionally uses AVX will - break with this option set. - - Setting this option on systems not vulnerable to GDS has no effect. - - If in doubt, say N. - config MITIGATION_RFDS bool "RFDS Mitigation" depends on CPU_SUP_INTEL |