[MODERATED] Re: [patch V10 10/10] Control knobs and Documentation 10

[Josh Poimboeuf <jpoimboe@redhat.com>]

On Thu, Jul 12, 2018 at 11:13:30AM -0500, Josh Poimboeuf wrote:
> > +Mitigation control on the kernel command line
> > +---------------------------------------------
> > +
> > +The kernel command line allows to control the L1TF mitigations at boot
> > +time with the option "l1tf=". The valid arguments for this option are:
> > +
> > +  ============  ===================================================
> > +  full		Provides all available mitigations for the L1TF
> > +		vulnerability. Disables SMT and enables all mitigations in
> > +		the hypervisors.
> > +
> > +		SMT control and L1D flush control via the sysfs interface
> > +		is still possible after boot.  Hypervisors will issue a
> > +		warning when the first VM is started in a potentially
> > +		insecure configuration, i.e. SMT enabled or L1D flush
> > +		disabled.
> > +
> > +  full,force	Same as 'full', but disables SMT and L1D flush runtime
> > +		control. Implies the 'nosmt=force' command line option.
> > +		(i.e. sysfs control of SMT is disabled.)
> > +
> > +  flush		Leaves SMT enabled and enables the default hypervisor
> > +		mitigation.
> > +
> > +		SMT control and L1D flush control via the sysfs interface
> > +		is still possible after boot.  Hypervisors will issue a
> > +		warning when the first VM is started in a potentially
> > +		insecure configuration, i.e. SMT enabled or L1D flush
> > +		disabled.
> 
> The difference is between 'flush' and 'full' is quite vague here (and in
> kernel-parameters.txt).  It might be a good idea to give a little more
> detail.

I meant to say between 'flush,nosmt' and 'full'...

-- 
Josh