If you force-disable mitigations on the kernel cmdline, for SPEC_STORE_BYPASS
this ends up with the prctl returning -ENXIO, but contrary to the current docs
for the other controls it returns -EPERM. Fix that.
Note that this return value should probably be considered a bug. But, making
the behaviour consistent with the current docs seems more likely to break
existing users than help anyone out in practice, so just "fix" it by
specifying it as correct.
Since this is getting more wordy and confusing, also be more explicit about
"control is not possible" be mentioning the boot configuration, to better
distinguish this case conceptually from the FORCE_DISABLE failure mode.
Signed-off-by: Brendan Jackman <jackmanb@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20251111-b4-prctl-docs-2-v2-1-bc9d14ec9662@google.com
ERANGE arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor
PR_SPEC_DISABLE nor PR_SPEC_FORCE_DISABLE.
-ENXIO Control of the selected speculation misfeature is not possible.
- See PR_GET_SPECULATION_CTRL.
+ENXIO For PR_SPEC_STORE_BYPASS: control of the selected speculation misfeature
+ is not possible via prctl, because of the system's boot configuration.
+
+EPERM Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller tried to
+ enable it again.
+
+EPERM For PR_SPEC_L1D_FLUSH and PR_SPEC_INDIRECT_BRANCH: control of the
+ mitigation is not possible because of the system's boot configuration.
-EPERM Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller
- tried to enable it again.
======= =================================================================
Speculation misfeature controls