From: David Laight <David.Laight@ACULAB.COM>
To: 'Borislav Petkov' <bp@alien8.de>, Breno Leitao <leitao@debian.org>
Cc: "tglx@linutronix.de" <tglx@linutronix.de>,
"pawan.kumar.gupta@linux.intel.com"
<pawan.kumar.gupta@linux.intel.com>,
"paul@paul-moore.com" <paul@paul-moore.com>,
"leit@meta.com" <leit@meta.com>,
"x86@kernel.org" <x86@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] cpu/bugs: Disable CPU mitigations at compilation time
Date: Mon, 12 Jun 2023 11:22:15 +0000 [thread overview]
Message-ID: <543116e1a8cf4b7a8b086c850374f99e@AcuMS.aculab.com> (raw)
In-Reply-To: <20230609173343.GDZINid4EgJGnkW7HK@fat_crate.local>
From: Borislav Petkov
> Sent: 09 June 2023 18:34
>
> On Fri, Feb 03, 2023 at 04:06:15AM -0800, Breno Leitao wrote:
> > Right now it is not possible to disable CPU vulnerabilities mitigations
> > at build time. Mitigation needs to be disabled passing kernel
> > parameters, such as 'mitigations=off'.
> >
> > Create a new config option (CONFIG_CPU_MITIGATIONS_DEFAULT_OFF) that
> > sets the global variable `cpu_mitigations` to OFF, instead of AUTO. This
> > allows the creation of kernel binaries that boots with the CPU
> > mitigations turned off by default, and does not require dealing kernel
> > parameters.
>
> What's the real-life use case for this?
I can definitely justify compiling them all out.
For instance embedded systems with limited userspace and
(pretty much) everything running as root.
Compiling them out gives better code than patching them out
during boot.
I've stopped updating an LTS kernel because I really don't
want/need any of the mitigations - especially the ones
associated with 'ret' instructions.
They are far more pervasive than the ones for indirect jumps.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
next prev parent reply other threads:[~2023-06-12 11:38 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-03 12:06 [PATCH] cpu/bugs: Disable CPU mitigations at compilation time Breno Leitao
2023-06-09 17:33 ` Borislav Petkov
2023-06-12 11:22 ` David Laight [this message]
2023-06-12 11:51 ` Borislav Petkov
2023-06-12 12:16 ` David Laight
2023-06-12 13:27 ` Borislav Petkov
2023-06-10 22:37 ` Thomas Gleixner
2023-06-12 12:54 ` Breno Leitao
2023-06-12 13:32 ` Borislav Petkov
2023-06-12 13:46 ` Breno Leitao
2023-06-12 13:53 ` Borislav Petkov
2023-06-12 14:16 ` Breno Leitao
2023-06-12 16:08 ` Borislav Petkov
2023-06-12 16:37 ` Breno Leitao
2023-06-12 17:05 ` Borislav Petkov
2023-06-13 16:02 ` Breno Leitao
2023-06-13 16:20 ` Borislav Petkov
2023-06-12 17:26 ` Thomas Gleixner
2023-06-12 18:06 ` Randy Dunlap
2023-06-12 18:13 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=543116e1a8cf4b7a8b086c850374f99e@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=bp@alien8.de \
--cc=leit@meta.com \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).