关闭侧信道攻击缓解，make Linux great again！

lscpu 会看到一些侧信道攻击缓解措施：

-> % lscpu
  ...
  Spec rstack overflow:      Mitigation; IBPB on VMEXIT only
  Spec store bypass:         Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:                Mitigation; usercopy/swapgs barriers and __user pointer sanitization
  Spectre v2:                Mitigation; Enhanced / Automatic IBRS; IBPB conditional; STIBP always-on; PBRSB-eIBRS Not affected; BHI Not affected

Wikipedia - Spectre

但是关我屁事，我是物理机用户，又不是云上的虚拟机用户。

以前有人做了一个 make linux great again 网站，但是下线了。

而且实际上也不需要 那一堆 配置，你只需要 mitigations=off 就行了。

# ArchLinux
-> % cat /boot/loader/entries/2025-06-30_04-02-18_linux.conf
# Created by: archinstall
# Created on: 2025-06-30_04-02-18
title   Arch Linux (linux)
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options root=PARTUUID=<uuid> zswap.enabled=0 rw rootfstype=btrfs mitigations=off

在 options 最后加上重启就完事。

# Fedora
sudo grubby --update-kernel=ALL --args="mitigations=off selinux=0"

检查好不好使：

-> % cat /proc/cmdline
initrd=\initramfs-linux.img root=PARTUUID=<uuid> zswap.enabled=0 rw rootfstype=btrfs amd_iommu=on amdttm.pages_limit=27648000 amdttm.page_pool_size=27648000 mitigations=off

-> % lscpu
  ...
  Spec rstack overflow:      Vulnerable
  Spec store bypass:         Vulnerable
  Spectre v1:                Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers
  Spectre v2:                Vulnerable; IBPB: disabled; STIBP: disabled; PBRSB-eIBRS: Not affected; BHI: Not affected