Linux 6.9 Making It Easier Managing Security Mitigation Options

The x86/core changes were submitted today for the now-open Linux 6.9 merge window. Among other changes, the x86 CPU security mitigation options within the Linux kernel Kconfig have been adjusted where appropriate to make more clear the options/features are for security mitigations.

Ingo Molnar submitted the x86/core changes already for Linux 6.9 and what is the "biggest change" is reworking the per-CPU code to support the GCC Named Address Spaces feature. The pull request explains of this GCC Named Address Spaces benefits as:

- This allows C code to access GS and FS segment relative memory via variables declared with such attributes, which allows the compiler to better optimize those accesses than the previous inline assembly code.

- The series also includes a number of micro-optimizations for various percpu access methods, plus a number of cleanups of %gs accesses in assembly code.

The x86/core pull also has some other code improvements, reworks the x86 idle code, and cleans up the CPU mitigations Kconfig options so they are easier to follow and maintain.

With the Kconfig security mitigation changes, they are now all clearly prefixed "CONFIG_MITIGATION_*" to avoid confusion by users. Affected options include CONFIG_GDS_FORCE_MITIGATION, CONFIG_CPU_IBPB_ENTRY, CONFIG_CALL_DEPTH_TRACKING, CONFIG_PAGE_TABLE_ISOLATION, CONFIG_RETPOLINE, CONFIG_SLS, CONFIG_CPU_UNRET_ENTRY, CONFIG_CPU_IBRS_ENTRY, CONFIG_CPU_SRSO, and CONFIG_RETHUNK. Just reading the Kconfig names, some users may think "SLS" may be some feature or so where in reality it's the knob for enabling the kernel code to mitigate straight-line speculation. Similarly, CALL_DEPTH_TRACKING, RETPOLINE, etc, aren't too familiar to the masses and could lead to confusion. So the new option names for Linux 6.9+ are CONFIG_MITIGATION_GDS_FORCE, CONFIG_MITIGATION_IBPB_ENTRY, CONFIG_MITIGATION_CALL_DEPTH_TRACKING, CONFIG_MITIGATION_PAGE_TABLE_ISOLATION, CONFIG_MITIGATION_RETPOLINE, CONFIG_MITIGATION_SLS, CONFIG_MITIGATION_UNRET_ENTRY, CONFIG_MITIGATION_IBRS_ENTRY, CONFIG_MITIGATION_SRSO, and CONFIG_MITIGATION_RETHUNK to make it very clear these options are for enabling mitigations.

These Kconfig mitigation option name changes also make it easier for those wanting to explicitly disable building a kernel with mitigations or wanting to easily see what mitigation options may be enabled for a given kernel configuration.

More details on the x86/core feature changes for Linux 6.9 via this pull request.