3 files changed, 63 insertions, 0 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 858b6c0b9a15..720ffa9c4e04 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2513,6 +2513,30 @@
                         in the "bleeding edge" mini2440 support kernel at
                         http://repo.or.cz/w/linux-2.6/mini2440.git
 
+        mitigations=
+                        Control optional mitigations for CPU vulnerabilities.
+                        This is a set of curated, arch-independent options, each
+                        of which is an aggregation of existing arch-specific
+                        options.
+
+                        off
+                                Disable all optional CPU mitigations.  This
+                                improves system performance, but it may also
+                                expose users to several CPU vulnerabilities.
+
+                        auto (default)
+                                Mitigate all CPU vulnerabilities, but leave SMT
+                                enabled, even if it's vulnerable.  This is for
+                                users who don't want to be surprised by SMT
+                                getting disabled across kernel upgrades, or who
+                                have other ways of avoiding SMT-based attacks.
+                                This is the default behavior.
+
+                        auto,nosmt
+                                Mitigate all CPU vulnerabilities, disabling SMT
+                                if needed.  This is for users who always want to
+                                be fully mitigated, even if it means losing SMT.
+
         mminit_loglevel=
                         [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
                         parameter allows control of the logging verbosity for
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 5041357d0297..2d9c6f4b78f5 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -187,4 +187,28 @@ static inline void cpu_smt_disable(bool force) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif
 
+/*
+ * These are used for a global "mitigations=" cmdline option for toggling
+ * optional CPU mitigations.
+ */
+enum cpu_mitigations {
+        CPU_MITIGATIONS_OFF,
+        CPU_MITIGATIONS_AUTO,
+        CPU_MITIGATIONS_AUTO_NOSMT,
+};
+
+extern enum cpu_mitigations cpu_mitigations;
+
+/* mitigations=off */
+static inline bool cpu_mitigations_off(void)
+{
+        return cpu_mitigations == CPU_MITIGATIONS_OFF;
+}
+
+/* mitigations=auto,nosmt */
+static inline bool cpu_mitigations_auto_nosmt(void)
+{
+        return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT;
+}
+
 #endif /* _LINUX_CPU_H_ */
diff --git a/kernel/cpu.c b/kernel/cpu.c
index d1c6d152da89..e70a90634b41 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2279,3 +2279,18 @@ void __init boot_cpu_hotplug_init(void)
 #endif
         this_cpu_write(cpuhp_state.state, CPUHP_ONLINE);
 }
+
+enum cpu_mitigations cpu_mitigations __ro_after_init = CPU_MITIGATIONS_AUTO;
+
+static int __init mitigations_parse_cmdline(char *arg)
+{
+        if (!strcmp(arg, "off"))
+                cpu_mitigations = CPU_MITIGATIONS_OFF;
+        else if (!strcmp(arg, "auto"))
+                cpu_mitigations = CPU_MITIGATIONS_AUTO;
+        else if (!strcmp(arg, "auto,nosmt"))
+                cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT;
+
+        return 0;
+}
+early_param("mitigations", mitigations_parse_cmdline);