Fix the handling of SPECULATION_MITIGATIONS=n so that it actually does
what it says it does: disable any and all mitigations.
And because I don't see a way to provide sane behavior for overriding
SPECULATION_MITIGATIONS=n at runtime, explicitly disallow doing so via
the "mitigations" kernel parameter, e.g. so that the user at least knows
that their system is still likely vulnerable to a variety of issues.
Sean Christopherson (3):
x86/cpu: Actually turn off mitigations by default for
SPECULATION_MITIGATIONS=n
x86/cpu: Disable BHI mitigation by default when
SPECULATION_MITIGATIONS=n
x86/cpu: Ignore "mitigations" kernel parameter if
SPECULATION_MITIGATIONS=n
Documentation/admin-guide/kernel-parameters.txt | 3 +++
arch/x86/Kconfig | 10 +++++++---
arch/x86/kernel/cpu/bugs.c | 6 +++---
kernel/cpu.c | 5 ++++-
4 files changed, 17 insertions(+), 7 deletions(-)
base-commit: 2c71fdf02a95b3dd425b42f28fd47fb2b1d22702
--
2.44.0.478.gd926399ef9-goog
On 4/9/24 10:51, Sean Christopherson wrote:
> Fix the handling of SPECULATION_MITIGATIONS=n so that it actually does
> what it says it does: disable any and all mitigations.
>
> And because I don't see a way to provide sane behavior for overriding
> SPECULATION_MITIGATIONS=n at runtime, explicitly disallow doing so via
> the "mitigations" kernel parameter, e.g. so that the user at least knows
> that their system is still likely vulnerable to a variety of issues.
>
> Sean Christopherson (3):
> x86/cpu: Actually turn off mitigations by default for
> SPECULATION_MITIGATIONS=n
> x86/cpu: Disable BHI mitigation by default when
> SPECULATION_MITIGATIONS=n
> x86/cpu: Ignore "mitigations" kernel parameter if
> SPECULATION_MITIGATIONS=n
>
> Documentation/admin-guide/kernel-parameters.txt | 3 +++
> arch/x86/Kconfig | 10 +++++++---
> arch/x86/kernel/cpu/bugs.c | 6 +++---
> kernel/cpu.c | 5 ++++-
> 4 files changed, 17 insertions(+), 7 deletions(-)
>
>
> base-commit: 2c71fdf02a95b3dd425b42f28fd47fb2b1d22702
Reviewed-by: Daniel Sneddon <[email protected]>