Re: [RFC PATCH 07/56] x86/bugs: Reset spectre_v2_user mitigations

[Borislav Petkov]

On Wed, Dec 03, 2025 at 05:02:24PM +0000, Kaplan, David wrote:
> We don't know how tasks are using this prctl().  Maybe the task only sets
> PR_SPEC_DISABLE around one specific function call.
> 
> What if a program starts up and queries the kernel and gets PR_SPEC_PRCTL so
> it thinks it can control things.  And then it calls
> PR_SPEC_DISABLE/PR_SPEC_ENABLE around one particular sensitive function.
> 
> And then at some point, it starts getting -EPERM...

Well, we can't have the cake and eat it too - at some point the admin will
override the setting the task did. There's no other way.

> It would be cleaner if userspace never saw errors, but the mitigation were
> just silently applied/not-applied.

As in: if dynamic mitigations are enabled, kernel stops returning EPERM but
simply overrides the mitigation setting and issues a pr_warn_once() that
PR_SPEC_PRCTL doesn't take effect anymore due to system-wide override?

Works for me...

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette