diff options
| author | Sean Christopherson <seanjc@google.com> | 2024-04-19 17:05:55 -0700 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2024-04-25 15:47:39 +0200 |
| commit | ce0abef6a1d540acef85068e0e82bdf1fbeeb0e9 (patch) | |
| tree | 351692e7d9b06fe49aa7f6d1419cde3a7200d13d /arch | |
| parent | fe42754b94a42d08cf9501790afc25c4f6a5f631 (diff) | |
| download | lwn-ce0abef6a1d540acef85068e0e82bdf1fbeeb0e9.tar.gz lwn-ce0abef6a1d540acef85068e0e82bdf1fbeeb0e9.zip | |
cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
Explicitly disallow enabling mitigations at runtime for kernels that were
built with CONFIG_CPU_MITIGATIONS=n, as some architectures may omit code
entirely if mitigations are disabled at compile time.
E.g. on x86, a large pile of Kconfigs are buried behind CPU_MITIGATIONS,
and trying to provide sane behavior for retroactively enabling mitigations
is extremely difficult, bordering on impossible. E.g. page table isolation
and call depth tracking require build-time support, BHI mitigations will
still be off without additional kernel parameters, etc.
[ bp: Touchups. ]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20240420000556.2645001-3-seanjc@google.com
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/Kconfig | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 619a04d5c131..928820e61cb5 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2495,9 +2495,13 @@ menuconfig CPU_MITIGATIONS help Say Y here to enable options which enable mitigations for hardware vulnerabilities (usually related to speculative execution). + Mitigations can be disabled or restricted to SMT systems at runtime + via the "mitigations" kernel parameter. - If you say N, all mitigations will be disabled. You really - should know what you are doing to say so. + If you say N, all mitigations will be disabled. This CANNOT be + overridden at runtime. + + Say 'Y', unless you really know what you are doing. if CPU_MITIGATIONS |