linux-kernel - [PATCH v4 10/11] x86/bugs: Remove GDS Force Kconfig option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240729164105.554296-11-leitao@debian.org>
Date: Mon, 29 Jul 2024 09:40:58 -0700
From: Breno Leitao <leitao@...ian.org>
To: bp@...en8.de,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Josh Poimboeuf <jpoimboe@...nel.org>,
	Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Cc: linux-kernel@...r.kernel.org,
	Daniel Sneddon <daniel.sneddon@...ux.intel.com>
Subject: [PATCH v4 10/11] x86/bugs: Remove GDS Force Kconfig option

Remove the MITIGATION_GDS_FORCE Kconfig option, which aggressively disables
AVX as a mitigation for Gather Data Sampling (GDS) vulnerabilities. This
option is not widely used by distros.

While removing the Kconfig option, retain the runtime configuration
ability through the `gather_data_sampling=force` kernel parameter. This
allows users to still enable this aggressive mitigation if needed,
without baking it into the kernel configuration.

This change simplifies the kernel configuration while maintaining
flexibility for runtime mitigation choices.

Cc: Daniel Sneddon <daniel.sneddon@...ux.intel.com>
Suggested-by: Borislav Petkov <bp@...en8.de>
Signed-off-by: Breno Leitao <leitao@...ian.org>
---
 arch/x86/Kconfig           | 19 -------------------
 arch/x86/kernel/cpu/bugs.c |  4 ----
 2 files changed, 23 deletions(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 2e72a07981b2..ab5b210c8315 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2610,25 +2610,6 @@ config MITIGATION_SLS
 	  against straight line speculation. The kernel image might be slightly
 	  larger.
 
-config MITIGATION_GDS_FORCE
-	bool "Force GDS Mitigation"
-	depends on CPU_SUP_INTEL
-	default n
-	help
-	  Gather Data Sampling (GDS) is a hardware vulnerability which allows
-	  unprivileged speculative access to data which was previously stored in
-	  vector registers.
-
-	  This option is equivalent to setting gather_data_sampling=force on the
-	  command line. The microcode mitigation is used if present, otherwise
-	  AVX is disabled as a mitigation. On affected systems that are missing
-	  the microcode any userspace code that unconditionally uses AVX will
-	  break with this option set.
-
-	  Setting this option on systems not vulnerable to GDS has no effect.
-
-	  If in doubt, say N.
-
 config MITIGATION_RFDS
 	bool "RFDS Mitigation"
 	depends on CPU_SUP_INTEL
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a7f20ae2fcf4..b2e752eeb098 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -735,11 +735,7 @@ enum gds_mitigations {
 	GDS_MITIGATION_HYPERVISOR,
 };
 
-#if IS_ENABLED(CONFIG_MITIGATION_GDS_FORCE)
-static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE;
-#else
 static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;
-#endif
 
 static const char * const gds_strings[] = {
 	[GDS_MITIGATION_OFF]		= "Vulnerable",
-- 
2.43.0