Skip to content

Commit 559a494

Browse files
bp3tk0vopsiff
authored andcommitted
Documentation/arch/x86: Hide clearcpuid=
This option was never meant to be used in production because it solely clears the X86_FEATURE kernel-internal representation of what CPUID bits it has detected and doesn't do any *proper* feature disablement like clearing CR4.CET in the user shadow stack case, for example. So remove its documentation so that it doesn't get used in production and people get silly ideas. It is meant strictly for debugging; and if a chicken bit for properly disabling a feature is warranted, then that would need proper enablement. No functional changes. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Mathias Krause <minipli@grsecurity.net> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: https://patch.msgid.link/20260520202508.160112-1-bp@kernel.org Link: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?h=x86/urgent&id=80501dff814eeccebf44a59340c3fe3a205eb120 Signed-off-by: WangYuli <wangyl5933@chinaunicom.cn>
1 parent 4dbb408 commit 559a494

2 files changed

Lines changed: 4 additions & 18 deletions

File tree

Documentation/admin-guide/kernel-parameters.txt

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -683,24 +683,6 @@
683683
cio_ignore= [S390]
684684
See Documentation/arch/s390/common_io.rst for details.
685685

686-
clearcpuid=X[,X...] [X86]
687-
Disable CPUID feature X for the kernel. See
688-
arch/x86/include/asm/cpufeatures.h for the valid bit
689-
numbers X. Note the Linux-specific bits are not necessarily
690-
stable over kernel options, but the vendor-specific
691-
ones should be.
692-
X can also be a string as appearing in the flags: line
693-
in /proc/cpuinfo which does not have the above
694-
instability issue. However, not all features have names
695-
in /proc/cpuinfo.
696-
Note that using this option will taint your kernel.
697-
Also note that user programs calling CPUID directly
698-
or using the feature without checking anything
699-
will still see it. This just prevents it from
700-
being used by the kernel or shown in /proc/cpuinfo.
701-
Also note the kernel might malfunction if you disable
702-
some critical bits.
703-
704686
clk_ignore_unused
705687
[CLK]
706688
Prevents the clock framework from automatically gating

Documentation/arch/x86/cpuinfo.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,10 @@ to disable features using the feature number as defined in
187187
Protection can be disabled using clearcpuid=514. The number 514 is calculated
188188
from #define X86_FEATURE_UMIP (16*32 + 2).
189189

190+
DO NOT USE this cmdline option in production - it is meant to be used only as
191+
a quick'n'dirty debugging aid to rule out a feature-enabling code is the
192+
culprit. If you use it, it'll taint the kernel.
193+
190194
In addition, there exists a variety of custom command-line parameters that
191195
disable specific features. The list of parameters includes, but is not limited
192196
to, nofsgsbase, nosgx, noxsave, etc. 5-level paging can also be disabled using

0 commit comments

Comments
 (0)