This is a note to let you know that I've just added the patch titled
x86/speculation: Add Kconfig option for GDS
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-speculation-add-kconfig-option-for-gds.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From db43d2f957a240b2f9d6d66ffdb2d09887623113 Mon Sep 17 00:00:00 2001
From: Daniel Sneddon <daniel.sneddon@xxxxxxxxxxxxxxx>
Date: Tue, 1 Aug 2023 18:58:31 +0200
Subject: x86/speculation: Add Kconfig option for GDS
From: Daniel Sneddon <daniel.sneddon@xxxxxxxxxxxxxxx>
commit 53cf5797f114ba2bd86d23a862302119848eff19 upstream
Gather Data Sampling (GDS) is mitigated in microcode. However, on
systems that haven't received the updated microcode, disabling AVX
can act as a mitigation. Add a Kconfig option that uses the microcode
mitigation if available and disables AVX otherwise. Setting this
option has no effect on systems not affected by GDS. This is the
equivalent of setting gather_data_sampling=force.
Signed-off-by: Daniel Sneddon <daniel.sneddon@xxxxxxxxxxxxxxx>
Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Acked-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Signed-off-by: Daniel Sneddon <daniel.sneddon@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/Kconfig | 19 +++++++++++++++++++
arch/x86/kernel/cpu/bugs.c | 4 ++++
2 files changed, 23 insertions(+)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2466,6 +2466,25 @@ config SLS
against straight line speculation. The kernel image might be slightly
larger.
+config GDS_FORCE_MITIGATION
+ bool "Force GDS Mitigation"
+ depends on CPU_SUP_INTEL
+ default n
+ help
+ Gather Data Sampling (GDS) is a hardware vulnerability which allows
+ unprivileged speculative access to data which was previously stored in
+ vector registers.
+
+ This option is equivalent to setting gather_data_sampling=force on the
+ command line. The microcode mitigation is used if present, otherwise
+ AVX is disabled as a mitigation. On affected systems that are missing
+ the microcode any userspace code that unconditionally uses AVX will
+ break with this option set.
+
+ Setting this option on systems not vulnerable to GDS has no effect.
+
+ If in doubt, say N.
+
endif
config ARCH_HAS_ADD_PAGES
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -658,7 +658,11 @@ enum gds_mitigations {
GDS_MITIGATION_HYPERVISOR,
};
+#if IS_ENABLED(CONFIG_GDS_FORCE_MITIGATION)
+static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE;
+#else
static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;
+#endif
static const char * const gds_strings[] = {
[GDS_MITIGATION_OFF] = "Vulnerable",
Patches currently in stable-queue which might be from daniel.sneddon@xxxxxxxxxxxxxxx are
queue-5.15/x86-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/arm-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-speculation-add-kconfig-option-for-gds.patch
queue-5.15/um-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/mips-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/init-x86-move-mem_encrypt_init-into-arch_cpu_finalize_init.patch
queue-5.15/sh-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-speculation-add-gather-data-sampling-mitigation.patch
queue-5.15/init-invoke-arch_cpu_finalize_init-earlier.patch
queue-5.15/kvm-add-gds_no-support-to-kvm.patch
queue-5.15/x86-fpu-move-fpu-initialization-into-arch_cpu_finalize_init.patch
queue-5.15/x86-speculation-add-force-option-to-gds-mitigation.patch
queue-5.15/init-remove-check_bugs-leftovers.patch
queue-5.15/init-provide-arch_cpu_finalize_init.patch
queue-5.15/m68k-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-init-initialize-signal-frame-size-late.patch
queue-5.15/sparc-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-fpu-mark-init-functions-__init.patch
queue-5.15/ia64-cpu-switch-to-arch_cpu_finalize_init.patch
queue-5.15/x86-fpu-remove-cpuinfo-argument-from-init-functions.patch
