mitigations=off is all you need on a recent kernel