Re: [PATCH 1/2] Documentation: clarify PR_SPEC_L1D_FLUSH

[Kees Cook <kees@kernel.org>]

On Wed, Oct 15, 2025 at 05:02:05PM +0000, Brendan Jackman wrote:
> For PR_SPEC_STORE_BYPASS and PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE
> means "disable the speculation bug" i.e. "enable the mitigation".
> 
> For PR_SPEC_L1D_FLUSH, PR_SPEC_DISABLE means "disable the mitigation".
> This is not obvious, so document it.

The only thing I can find in Debian Code Search that actually uses
PR_SPEC_L1D_FLUSH is stress-ng, and it literally just toggles it before
restoring it:
https://sources.debian.org/src/stress-ng/0.19.05-1/stress-prctl.c?hl=893#L893

I wonder if we should just fix the prctl to match the existing
behaviors?

-Kees

> 
> Signed-off-by: Brendan Jackman <jackmanb@google.com>
> ---
>  Documentation/userspace-api/spec_ctrl.rst | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst
> index 5e8ed9eef9aa84f12fa255af7b15c163ff01aab8..ca89151fc0a8e7205e0a0062134d63b213b9ef11 100644
> --- a/Documentation/userspace-api/spec_ctrl.rst
> +++ b/Documentation/userspace-api/spec_ctrl.rst
> @@ -26,7 +26,8 @@ PR_GET_SPECULATION_CTRL
>  
>  PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature
>  which is selected with arg2 of prctl(2). The return value uses bits 0-3 with
> -the following meaning:
> +the following meaning (with the caveat that PR_SPEC_L1D_FLUSH has less obvious
> +semantics, see documentation for that specific control below):
>  
>  ==== ====================== ==================================================
>  Bit  Define                 Description
> @@ -110,6 +111,9 @@ Speculation misfeature controls
>  - PR_SPEC_L1D_FLUSH: Flush L1D Cache on context switch out of the task
>                          (works only when tasks run on non SMT cores)
>  
> +For this control, PR_SPEC_ENABLE means that the **mitigation** is enabled (L1D
> +is flushed), PR_SPEC_DISABLE means it is disabled.
> +
>    Invocations:
>     * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, 0, 0, 0);
>     * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_L1D_FLUSH, PR_SPEC_ENABLE, 0, 0);
> 
> -- 
> 2.50.1
> 

-- 
Kees Cook