There is no way to disable MMIO Stale data mitigation today at
compilation time. These mitigations are enabled even if
CONFIG_SPECULATION_MITIGATIONS is unset.
Create a new KCONFIG option that allow MMIO mitigation to be disabled in
compilation time.
Signed-off-by: Breno Leitao <[email protected]>
---
arch/x86/Kconfig | 10 ++++++++++
arch/x86/kernel/cpu/bugs.c | 10 ++++++++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 140af3b30c45..ba64f7c9b08d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2670,6 +2670,16 @@ config MITIGATE_TAA
which is available in various CPU internal buffers by using
asynchronous aborts within an Intel TSX transactional region.
+config MITIGATE_MMIO_STALE_DATA
+ bool "Mitigate MMIO Stale Data hardware bug"
+ depends on CPU_SUP_INTEL && X86_64
+ default y
+ help
+ Enable mitigation for MMIO Stale Data hardware bugs. Processor MMIO
+ Stale Data Vulnerabilities are a class of memory-mapped I/O (MMIO)
+ vulnerabilities that can expose data. The vulnerabilities require the
+ attacker to have access to MMIO.
+
endif
config ARCH_HAS_ADD_PAGES
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 3615bda9573f..b5c171feb05e 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -439,6 +439,7 @@ enum mmio_mitigations {
/* Default mitigation for Processor MMIO Stale Data vulnerabilities */
static enum mmio_mitigations mmio_mitigation __ro_after_init = MMIO_MITIGATION_VERW;
static bool mmio_nosmt __ro_after_init = false;
+#define MMIO_WARN_MSG "WARNING: MMIO Stale Data speculative mitigation disabled!\n"
static const char * const mmio_strings[] = {
[MMIO_MITIGATION_OFF] = "Vulnerable",
@@ -451,12 +452,17 @@ static void __init mmio_select_mitigation(void)
u64 ia32_cap;
if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) ||
- boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN) ||
- cpu_mitigations_off()) {
+ boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN)) {
mmio_mitigation = MMIO_MITIGATION_OFF;
return;
}
+ if (cpu_mitigations_off() || !IS_ENABLED(CONFIG_MITIGATE_MDS)) {
+ mmio_mitigation = MMIO_MITIGATION_OFF;
+ pr_err(MMIO_WARN_MSG);
+ return;
+ }
+
if (mmio_mitigation == MMIO_MITIGATION_OFF)
return;
--
2.34.1