[MODERATED] Re: [patch 1/2] Command line and documentation 1

[Andi Kleen <ak@linux.intel.com>]

On Mon, Jul 09, 2018 at 02:45:57PM -0700, speck for Andi Kleen wrote:
> > +				Leaves SMT enabled and does not enable the
> > +				hypervisor mitigation. Hypervisors will
> > +				issue a warning when the first VM is being
> > +				started in a potentially insecure
> > +				configuration, i.e. SMT enabled or L1D
> > +				flush disabled.
> > +
> > +			novirt,nowarn
> > +				Same as 'novirt', but hypervisors will not
> > +				warn when a VM is started in a potentially
> > +				insecure configuration.
> 
> So why is there no option to only enable the L1D flush? 
> 
> It would seem to me that would be better default than no mitigation at all.
> 
> >  
> > +enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_NOVIRT;
> 
> Can you remind me why there is no sysfs interface for this?

Ok it looks like with the KVM parameter it's already there.
Just need to refer to it from here.

"These options can be also switched at run time with
/sys/module/kvm/parameters/... " 

> 
> Jiri originally wanted boot options because apparently
> they have an no ability to install a new boot up script in an update. 
> So the need for an boot up option is more an hack to work
> around this deficiency.
> 
> But I suspect long term for most users it's far
> better to handle this dynamically at run time, and not
> do unnecessary reboots, and I can't see any reason 
> why that wouldn't be possible.
> 
> So should have a sysfs interface.