* Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
> Explicitly disallow enabling mitigations at runtime for kernels that were
> built with CONFIG_SPECULATION_MITIGATIONS=n. Because more Kconfigs are
> buried behind SPECULATION_MITIGATIONS, trying to provide sane behavior for
> retroactively enabling mitigations is extremely difficult, bordering on
> impossible. E.g. page table isolation and call depth tracking requrie
> build-time support, BHI mitigations will still be off without additional
> kernel parameters, etc.
>
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
> Documentation/admin-guide/kernel-parameters.txt | 3 +++
> arch/x86/Kconfig | 10 +++++++---
> kernel/cpu.c | 2 ++
> 3 files changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index 70046a019d42..7d623df11a1a 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -3423,6 +3423,9 @@
> arch-independent options, each of which is an
> aggregation of existing arch-specific options.
>
> + Note, "mitigations" is supported on x86 if and only if
> + the kernel was built with SPECULATION_MITIGATIONS=y.
> +
> off
> Disable all optional CPU mitigations. This
> improves system performance, but it may also
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 10a6251f58f3..f4e4dd360636 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2493,10 +2493,14 @@ menuconfig SPECULATION_MITIGATIONS
> default y
> help
> Say Y here to enable options which enable mitigations for
> - speculative execution hardware vulnerabilities.
> + speculative execution hardware vulnerabilities. Mitigations can
> + be disabled or restricted to SMT systems at runtime via the
> + "mitigations" kernel parameter.
>
> - If you say N, all mitigations will be disabled. You really
> - should know what you are doing to say so.
> + If you say N, all mitigations will be disabled. This CANNOT be
> + overridden at runtime.
> +
> + Say 'Y', unless you really know what you are doing.
>
> if SPECULATION_MITIGATIONS
>
> diff --git a/kernel/cpu.c b/kernel/cpu.c
> index 07ad53b7f119..d445763d8047 100644
> --- a/kernel/cpu.c
> +++ b/kernel/cpu.c
> @@ -3214,6 +3214,8 @@ static int __init mitigations_parse_cmdline(char *arg)
> {
> if (!strcmp(arg, "off"))
> cpu_mitigations = CPU_MITIGATIONS_OFF;
> + else if (!IS_ENABLED(CONFIG_SPECULATION_MITIGATIONS))
> + pr_crit("Kernel compiled without mitigations, system may still be vulnerable\n");
This doesn't really make it clear that the kernel is actively ignoring the
mitigations= command line. I think something like this would be more clear:
> + pr_crit("Kernel compiled without mitigations, ignoring mitigations= boot option. System may still be vulnerable\n");
Thanks,
Ingo
