From b8e4813f09b8220f50f714e0aee17696c1798ede Mon Sep 17 00:00:00 2001 From: Henrik Lissner Date: Sun, 21 Feb 2021 10:30:01 -0500 Subject: [PATCH] Clean up & revise hardware-configuration comments --- hosts/kuro/hardware-configuration.nix | 5 ++--- hosts/shiro/hardware-configuration.nix | 14 ++++++-------- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/hosts/kuro/hardware-configuration.nix b/hosts/kuro/hardware-configuration.nix index f95eb2e8..dff7579d 100644 --- a/hosts/kuro/hardware-configuration.nix +++ b/hosts/kuro/hardware-configuration.nix @@ -10,9 +10,8 @@ kernelModules = [ "kvm-amd" ]; kernelParams = [ # HACK Disables fixes for spectre, meltdown, L1TF and a number of CPU - # vulnerabilities. This is not a good idea for mission critical or - # server/headless builds, but on my lonely home system I prioritize - # raw performance over security. The gains are minor. + # vulnerabilities. Don't copy this blindly! And especially not for + # mission critical or server/headless builds exposed to the world. "mitigations=off" ]; }; diff --git a/hosts/shiro/hardware-configuration.nix b/hosts/shiro/hardware-configuration.nix index 1b5f1f28..d3085fea 100644 --- a/hosts/shiro/hardware-configuration.nix +++ b/hosts/shiro/hardware-configuration.nix @@ -1,6 +1,3 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. { config, lib, pkgs, inputs, modulesPath, ... }: { @@ -14,11 +11,12 @@ initrd.kernelModules = [ "dm-snapshot" ]; kernelModules = [ "kvm-intel" ]; extraModulePackages = [ ]; - # HACK Disables fixes for spectre, meltdown, L1TF and a number of CPU - # vulnerabilities. This is not a good idea for mission critical or - # server/headless builds, but Kuro isn't either. I'll prioritize raw - # performance over security here, though the gains are minor. - kernelParams = [ "mitigations=off" ]; + kernelParams = [ + # HACK Disables fixes for spectre, meltdown, L1TF and a number of CPU + # vulnerabilities. Don't copy this blindly! And especially not for + # mission critical or server/headless builds exposed to the world. + "mitigations=off" + ]; }; # Modules