Messages in this thread Patch in this message | | | Date | Wed, 11 Oct 2023 09:49:55 -0700 | From | Josh Poimboeuf <> | Subject | Re: [PATCH v4] x86/bugs: Add a separate config for each mitigation |
| |
On Wed, Oct 11, 2023 at 05:20:59AM -0700, Breno Leitao wrote: > On Tue, Oct 10, 2023 at 09:42:52PM -0700, Josh Poimboeuf wrote: > > On Tue, Oct 10, 2023 at 03:30:27AM -0700, Breno Leitao wrote: > > > +config MITIGATE_MDS > > > + bool "Mitigate Microarchitectural Data Sampling (MDS) hardware bug" > > > + depends on CPU_SUP_INTEL > > > + default y > > > + help > > > + Enable mitigation for Microarchitectural Data Sampling (MDS). MDS is > > > + a hardware vulnerability which allows unprivileged speculative access > > > + to data which is available in various CPU internal buffer. Deeper > > > + technical information is available in the MDS specific x86 architecture > > > + section: Documentation/arch/x86/mds.rst. > > > > MITIGATE_GDS seems to be missing? > > GDS is named `GDS_FORCE_MITIGATION` instead of MITIGATE_GDS. See > 11cf22869ea ("x86/speculation: Add Kconfig option for GDS")
Enabling/disabling GDS_FORCE_MITIGATION doesn't enable/disable the mitigation, it just changes the default.
For consistency that option should probably be renamed to MITIGATION_GDS_FORCE. It should depend on MITIGATION_GDS. If MITIGATION_GDS is disabled, gds_mitigation should default to GDS_MITIGATION_OFF.
e.g., something like
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 66bfabae8814..c8c879302b37 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2549,9 +2549,16 @@ config SLS against straight line speculation. The kernel image might be slightly larger. -config GDS_FORCE_MITIGATION - bool "Force GDS Mitigation" +config MITIGATION_GDS + bool" Mitigate Gather Data Sampling" depends on CPU_SUP_INTEL + default y + help + (Insert actual description here) + +config MITIGATION_GDS_FORCE + bool "Force GDS Mitigation" + depends on MITIGATION_GDS default n help Gather Data Sampling (GDS) is a hardware vulnerability which allows diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index f081d26616ac..43ad3eee3d4c 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -671,11 +671,15 @@ enum gds_mitigations { GDS_MITIGATION_HYPERVISOR, }; -#if IS_ENABLED(CONFIG_GDS_FORCE_MITIGATION) +#if IS_ENABLED(CONFIG_MITIGATION_GDS) +#if IS_ENABLED(CONFIG_MITIGATION_GDS_FORCE) static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE; #else static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL; #endif +#else +static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_OFF; +#endif static const char * const gds_strings[] = { [GDS_MITIGATION_OFF] = "Vulnerable",
| |