Commit fe42754b authored by Sean Christopherson's avatar Sean Christopherson Committed by Borislav Petkov (AMD)
Browse files

cpu: Re-enable CPU mitigations by default for !X86 architectures 

Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it
on for all architectures exception x86.  A recent commit to turn
mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta
missed that "cpu_mitigations" is completely generic, whereas
SPECULATION_MITIGATIONS is x86-specific.

Rename x86's SPECULATIVE_MITIGATIONS instead of keeping both and have it
select CPU_MITIGATIONS, as having two configs for the same thing is
unnecessary and confusing.  This will also allow x86 to use the knob to
manage mitigations that aren't strictly related to speculative
execution.

Use another Kconfig to communicate to common code that CPU_MITIGATIONS
is already defined instead of having x86's menu depend on the common
CPU_MITIGATIONS.  This allows keeping a single point of contact for all
of x86's mitigations, and it's not clear that other architectures *want*
to allow disabling mitigations at compile-time.

Fixes: f337a6a2 ("x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n")
Closes: https://lkml.kernel.org/r/20240413115324.53303a68%40canb.auug.org.au


Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
Reported-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Acked-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Acked-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240420000556.2645001-2-seanjc@google.com
parent a0a8d15a

arch/Kconfig

+8 −0
Original line number Diff line number Diff line
@@ -9,6 +9,14 @@ 
#

source "arch/$(SRCARCH)/Kconfig"



config ARCH_CONFIGURES_CPU_MITIGATIONS

	bool



if !ARCH_CONFIGURES_CPU_MITIGATIONS

config CPU_MITIGATIONS

	def_bool y

endif



menu "General architecture-dependent options"



config ARCH_HAS_SUBPAGE_FAULTS

arch/x86/Kconfig

+6 −5
Original line number Diff line number Diff line
@@ -62,6 +62,7 @@ config X86 
	select ACPI_HOTPLUG_CPU			if ACPI_PROCESSOR && HOTPLUG_CPU

	select ARCH_32BIT_OFF_T			if X86_32

	select ARCH_CLOCKSOURCE_INIT

	select ARCH_CONFIGURES_CPU_MITIGATIONS

	select ARCH_CORRECT_STACKTRACE_ON_KRETPROBE

	select ARCH_ENABLE_HUGEPAGE_MIGRATION if X86_64 && HUGETLB_PAGE && MIGRATION

	select ARCH_ENABLE_MEMORY_HOTPLUG if X86_64
@@ -2488,17 +2489,17 @@ config PREFIX_SYMBOLS 
	def_bool y

	depends on CALL_PADDING && !CFI_CLANG



menuconfig SPECULATION_MITIGATIONS

	bool "Mitigations for speculative execution vulnerabilities"

menuconfig CPU_MITIGATIONS

	bool "Mitigations for CPU vulnerabilities"

	default y

	help

	  Say Y here to enable options which enable mitigations for

	  speculative execution hardware vulnerabilities.

	  Say Y here to enable options which enable mitigations for hardware

	  vulnerabilities (usually related to speculative execution).



	  If you say N, all mitigations will be disabled. You really

	  should know what you are doing to say so.



if SPECULATION_MITIGATIONS

if CPU_MITIGATIONS



config MITIGATION_PAGE_TABLE_ISOLATION

	bool "Remove the kernel mapping in user mode"

kernel/cpu.c

+2 −2
Original line number Diff line number Diff line
@@ -3207,7 +3207,7 @@ enum cpu_mitigations { 
};



static enum cpu_mitigations cpu_mitigations __ro_after_init =

	IS_ENABLED(CONFIG_SPECULATION_MITIGATIONS) ? CPU_MITIGATIONS_AUTO :

	IS_ENABLED(CONFIG_CPU_MITIGATIONS) ? CPU_MITIGATIONS_AUTO :

					     CPU_MITIGATIONS_OFF;



static int __init mitigations_parse_cmdline(char *arg)