Re: [PATCH] cpu/bugs: Disable CPU mitigations at compilation time

[Breno Leitao <leitao@debian.org>]

On Sun, Jun 11, 2023 at 12:37:34AM +0200, Thomas Gleixner wrote:
> On Fri, Feb 03 2023 at 04:06, Breno Leitao wrote:
> > Right now it is not possible to disable CPU vulnerabilities mitigations
> > at build time. Mitigation needs to be disabled passing kernel
> > parameters, such as 'mitigations=off'.
> >
> > Create a new config option (CONFIG_CPU_MITIGATIONS_DEFAULT_OFF) that
> > sets the global variable `cpu_mitigations` to OFF, instead of AUTO. This
> > allows the creation of kernel binaries that boots with the CPU
> > mitigations turned off by default, and does not require dealing kernel
> > parameters.
> 
> Why? What's the justification

There are two major justification from my point of view:

1) We keep consistency with other CONFIG options. Linux already has a
CONFIG option to enable/disable mitigations for speculations
(CONFIG_SPECULATION_MITIGATIONS), so, this will be a similar one.

2) There are companies that have different kernel flavours (different
CONFIG options basically), for different type of workloads, and a
machine can change their kernel flavors a few times a day.  I.e, for
a specifically workload, boots in flavor X since it works the best.
Mitigation enabled/disabled is key to some of these flavors.

I would like to see a flavor as self-contained in a binary that I can
mix and match. Right not they are not, since for some kernel
flavours, you need to add kernel command lines (mitigations=off), which
requires some hard logic, mainly when you are dealing with kexec and
grub.