[MODERATED] Re: [patch 2/2] Command line and documentation 2

[Ingo Molnar <mingo@kernel.org>]

* speck for Jiri Kosina <speck@linutronix.de> wrote:

> On Mon, 9 Jul 2018, speck for Ingo Molnar wrote:
> 
> > > +  novirt,nowarn: Same as 'novirt', but hypervisors will not warn when
> > > +		 a VM is started in a potentially insecure configuration.
> > > +
> > > +The default is 'novirt'.
> > 
> > Isn't the default 'novirt,nowarn'?
> 
> No, the default absolutely is 'novirt'

Indeed - I just mis-remembered it: "novirt,nowarn" is the last entry in the 
values, not the default.

> 
> 	/* Default mitigation for L1TF-affected CPUs */
> 	enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_NOVIRT;
> 
> I don't think making default 'novirt,nowarn' would make any sense really. 
> It's uncomfortable enough that the kernel is by default not turning the 
> protection on.
> 
> If it wouldn't be even issuing a warning, that'd be rather bad.

Yeah, agreed.

Thanks,

	Ingo