Re: [Patch v5 11/16] x86/speculation: Add Spectre v2 app to app protection modes

[Thomas Gleixner]

On Mon, 19 Nov 2018, Tim Chen wrote:
> On 11/19/2018 05:32 AM, Thomas Gleixner wrote:
> > On Fri, 16 Nov 2018, Tim Chen wrote:
> >> The protection mode can be specified by the spectre_v2_app2app
> >> boot parameter with the following semantics:
> >>
> >> spectre_v2_app2app=
> >> 	off    - Turn off mitigation
> >> 	lite   - Protect processes which are marked non-dumpable
> >> 	strict - Protect all processes
> >> 	auto   - Kernel selects the mode
> > 
> > Is there any reason why we need yet another naming convention?
> > 
> > pti= 				on, off, auto
> > 
> > spectre_v2=			on, off, auto
> > 
> > spec_store_bypass_disable =	on, off, auto, prctl, seccomp
> 
> The "on" option is set by spectre_v2=on so is not specified here.

What has spectre_v2=on to do with spectre_v2_app2app=on?

Exactly nothing. You can have 'on' for both. The only side effect of
spectre_v2=on is that it also forces spectre_v2_app2app to 'on'
irrespective of what eventually was added for spectre_v2_app2app= on the
command line.

> What will you like to name the "lite" and "strict" option instead?

'prctl' and 'on' and if we add 'seccomp' then this is exactly the same as
we have for ssbd.

> > Can we please have a full documentation for all the spectre_v2 stuff
> > similar to l1tf?
> > 
> Sure.  Can we do that as a separate patch?  I'll need some time 
> and internal review for any spectre_v2 documentation that's produced.

I'm not taking that stuff without proper documentation. I complained about
that vs. L1TF and got told that no sysadmin cares, but L1TF has shown that
they care very much and appreciate proper documentation.

Nobody can oracle the protection scope out of that inconsistent command
line maze.

Thanks,

	tglx