Hacker News Reader

The AVX disable is only when you use "gather_data_sampling=force". The default is to leave AVX alone and proclaim the system to be vulnerable.

From https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... :

> Specifying "gather_data_sampling=force" will use the microcode mitigation when > available or disable AVX on affected systems where the microcode hasn't been > updated to include the mitigation.

Disclaimer: I work on Linux at Intel. I probably wrote or tweaked the documentation and changelogs that are confusing folks.

Great, thanks for the clarification

`[ 0.000000] microcode: updated early: 0x27 -> 0x28, date = 2019-11-12`

I'm on haswell. Is there a list of what CPUs get updated microcode? Sad.

haswell isn't vulnerable, it only affects skylake or later

Maybe that's not the default? Not entirely clear from the text.