Re: [PATCH] arm64: proton-pack: Restore the nospectre_bhb command-line option

[Will Deacon]

On Sat, Jul 25, 2026 at 02:29:59PM +0200, Karl Mehltretter wrote:
> Commit 7f1635737823 ("arm64: proton-pack: Fix hard lockup due to print in
> scheduler context") moved the "mitigation disabled" printks into
> spectre_print_disabled_mitigations(). For spectre-v2 and spectre-v4 only
> the pr_info_once() calls were removed, but for spectre-bhb the whole
> branch went with the print:
> 
>   -	} else if (cpu_mitigations_off() || __nospectre_bhb) {
>   -		pr_info_once("spectre-bhb mitigation disabled ...\n");
> 
> spectre_bhb_enable_mitigation() therefore no longer tests __nospectre_bhb
> or cpu_mitigations_off() and the mitigation is enabled regardless of the
> command line. The flag survives only in its __setup handler and in
> spectre_print_disabled_mitigations(), so the kernel prints "spectre-bhb
> mitigation disabled by command-line option" while
> /sys/devices/system/cpu/vulnerabilities/spectre_v2 reports "Mitigation:
> CSV2, BHB" and the vectors are switched to EL1_VECTOR_BHB_LOOP.
> 
> The only remaining escape is the SPECTRE_VULNERABLE arm at the top of the
> chain, which a CSV2 core never reaches, so from Cortex-A76 and Neoverse N1
> onwards both nospectre_bhb and mitigations=off are ignored. Both are
> documented in Documentation/admin-guide/kernel-parameters.txt.
> 
> The identical mistake was made on the neighbouring branch by the
> immediately preceding commit 62e72463ca71 ("arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY")
> and fixed by commit 165eb13e485c ("arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY");
> this one was missed. build_bhb_mitigation() in arch/arm64/net/bpf_jit_comp.c
> still tests both flags, so nospectre_bhb currently keeps the exception-vector
> loop while dropping the cBPF epilogue mitigation.
> 
> Restore the branch. The print already lives in
> spectre_print_disabled_mitigations(), so only the guard is needed.
> 
> Tested under QEMU with -cpu neoverse-n1 (CSV2, no ECBHB, no CLRBHB).
> Before, spectre_v2 read "Mitigation: CSV2, BHB" with and without the
> option; after, nospectre_bhb and mitigations=off both give "Mitigation:
> CSV2, but not BHB" and a boot without either is unchanged.
> 
> Fixes: 7f1635737823 ("arm64: proton-pack: Fix hard lockup due to print in scheduler context")
> Assisted-by: Claude:claude-opus-5
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> ---
>  arch/arm64/kernel/proton-pack.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
> index 7bb6553fec08..4eaa523cdeb9 100644
> --- a/arch/arm64/kernel/proton-pack.c
> +++ b/arch/arm64/kernel/proton-pack.c
> @@ -1036,6 +1036,8 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
>  		/* No point mitigating Spectre-BHB alone. */
>  	} else if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) {
>  		/* Do nothing */
> +	} else if (cpu_mitigations_off() || __nospectre_bhb) {

Can you stick this in a spectre_bhb_mitigations_off() helper that can be
used both here and in spectre_print_disabled_mitigations(), please?

Will