diff options
| author | Breno Leitao <leitao@debian.org> | 2024-07-29 18:40:59 +0200 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2024-07-30 14:54:15 +0200 |
| commit | 225f2bd064c32397acfe3d9dfd9a2b3bc6d64fd7 (patch) | |
| tree | 18f609a1a4452133e978cad41adbf7e74952cf7b /arch/x86/Kconfig | |
| parent | x86/bugs: Remove GDS Force Kconfig option (diff) | |
| download | linux-225f2bd064c32397acfe3d9dfd9a2b3bc6d64fd7.tar.xz linux-225f2bd064c32397acfe3d9dfd9a2b3bc6d64fd7.zip | |
x86/bugs: Add a separate config for GDS
Currently, the CONFIG_SPECULATION_MITIGATIONS is halfway populated, where some
mitigations have entries in Kconfig, and they could be modified, while others
mitigations do not have Kconfig entries, and could not be controlled at build
time.
Create a new kernel config that allows GDS to be completely disabled,
similarly to the "gather_data_sampling=off" or "mitigations=off" kernel
command-line.
Now, there are two options for GDS mitigation:
* CONFIG_MITIGATION_GDS=n -> Mitigation disabled (New)
* CONFIG_MITIGATION_GDS=y -> Mitigation enabled (GDS_MITIGATION_FULL)
Suggested-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20240729164105.554296-12-leitao@debian.org
Diffstat (limited to 'arch/x86/Kconfig')
| -rw-r--r-- | arch/x86/Kconfig | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index ab5b210c8315..475bc538615e 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2610,6 +2610,16 @@ config MITIGATION_SLS against straight line speculation. The kernel image might be slightly larger. +config MITIGATION_GDS + bool "Mitigate Gather Data Sampling" + depends on CPU_SUP_INTEL + default y + help + Enable mitigation for Gather Data Sampling (GDS). GDS is a hardware + vulnerability which allows unprivileged speculative access to data + which was previously stored in vector registers. The attacker uses gather + instructions to infer the stale vector register data. + config MITIGATION_RFDS bool "RFDS Mitigation" depends on CPU_SUP_INTEL |