x86/bugs: Move cpu_bugs_smt_update() down

jira LE-4704
cve CVE-2025-40300
Rebuild_History Non-Buildable kernel-4.18.0-553.83.1.el8_10
commit-author Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit 6449f5b
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/6449f5ba.failed

cpu_bugs_smt_update() uses global variables from different mitigations. For
SMT updates it can't currently use vmscape_mitigation that is defined after
it.

Since cpu_bugs_smt_update() depends on many other mitigations, move it
after all mitigations are defined. With that, it can use vmscape_mitigation
in a moment.

No functional change.

	Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
	Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
	Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
(cherry picked from commit 6449f5b)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

# Conflicts:
#	arch/x86/kernel/cpu/bugs.c

Author: PlaidCat

ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/6449f5ba.failed

@@ -0,0 +1,288 @@
+x86/bugs: Move cpu_bugs_smt_update() down
+
+jira LE-4704
+cve CVE-2025-40300
+Rebuild_History Non-Buildable kernel-4.18.0-553.83.1.el8_10
+commit-author Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+commit 6449f5baf9c78a7a442d64f4a61378a21c5db113
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.83.1.el8_10/6449f5ba.failed
+
+cpu_bugs_smt_update() uses global variables from different mitigations. For
+SMT updates it can't currently use vmscape_mitigation that is defined after
+it.
+
+Since cpu_bugs_smt_update() depends on many other mitigations, move it
+after all mitigations are defined. With that, it can use vmscape_mitigation
+in a moment.
+
+No functional change.
+
+	Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+	Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+	Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+(cherry picked from commit 6449f5baf9c78a7a442d64f4a61378a21c5db113)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	arch/x86/kernel/cpu/bugs.c
+diff --cc arch/x86/kernel/cpu/bugs.c
+index a556e8ade674,1f8c1c51d057..000000000000
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@@ -1877,206 -2492,65 +1877,209 @@@ static void __init spectre_v2_select_mi
+  		setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+  		pr_info("Enabling Restricted Speculation for firmware calls\n");
+  	}
+ -}
+  
+ -static void update_stibp_msr(void * __unused)
+ -{
+ -	u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP);
+ -	update_spec_ctrl(val);
+ +	/* Set up IBPB and STIBP depending on the general spectre V2 command */
+ +	spectre_v2_cmd = cmd;
+ +}
+ +
+ +static void update_stibp_msr(void * __unused)
+ +{
+ +	u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP);
+ +	update_spec_ctrl(val);
+ +}
+ +
+ +/* Update x86_spec_ctrl_base in case SMT state changed. */
+ +static void update_stibp_strict(void)
+ +{
+ +	u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+ +
+ +	if (sched_smt_active())
+ +		mask |= SPEC_CTRL_STIBP;
+ +
+ +	if (mask == x86_spec_ctrl_base)
+ +		return;
+ +
+ +	pr_info("Update user space SMT mitigation: STIBP %s\n",
+ +		mask & SPEC_CTRL_STIBP ? "always-on" : "off");
+ +	x86_spec_ctrl_base = mask;
+ +	on_each_cpu(update_stibp_msr, NULL, 1);
+ +}
+ +
+ +/* Update the static key controlling the evaluation of TIF_SPEC_IB */
+ +static void update_indir_branch_cond(void)
+ +{
+ +	if (sched_smt_active())
+ +		static_branch_enable(&switch_to_cond_stibp);
+ +	else
+ +		static_branch_disable(&switch_to_cond_stibp);
+ +}
+ +
+ +#undef pr_fmt
+ +#define pr_fmt(fmt) fmt
+ +
+ +/* Update the static key controlling the MDS CPU buffer clear in idle */
+ +static void update_mds_branch_idle(void)
+ +{
+ +	/*
+ +	 * Enable the idle clearing if SMT is active on CPUs which are
+ +	 * affected only by MSBDS and not any other MDS variant.
+ +	 *
+ +	 * The other variants cannot be mitigated when SMT is enabled, so
+ +	 * clearing the buffers on idle just to prevent the Store Buffer
+ +	 * repartitioning leak would be a window dressing exercise.
+ +	 */
+ +	if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
+ +		return;
+ +
+ +	if (sched_smt_active()) {
+ +		static_branch_enable(&mds_idle_clear);
+ +	} else if (mmio_mitigation == MMIO_MITIGATION_OFF ||
+ +		   (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {
+ +		static_branch_disable(&mds_idle_clear);
+ +	}
+ +}
+ +
+++<<<<<<< HEAD
+ +#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
+ +#define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
+ +#define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"
+ +
+ +void cpu_bugs_smt_update(void)
+ +{
+ +	mutex_lock(&spec_ctrl_mutex);
+ +
+ +	if (sched_smt_active() && unprivileged_ebpf_enabled() &&
+ +	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
+ +		pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);
+ +
+ +	switch (spectre_v2_user_stibp) {
+ +	case SPECTRE_V2_USER_NONE:
+ +		break;
+ +	case SPECTRE_V2_USER_STRICT:
+ +	case SPECTRE_V2_USER_STRICT_PREFERRED:
+ +		update_stibp_strict();
+ +		break;
+ +	case SPECTRE_V2_USER_PRCTL:
+ +	case SPECTRE_V2_USER_SECCOMP:
+ +		update_indir_branch_cond();
+ +		break;
+ +	}
+ +
+ +	switch (mds_mitigation) {
+ +	case MDS_MITIGATION_FULL:
+ +	case MDS_MITIGATION_VMWERV:
+ +		if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
+ +			pr_warn_once(MDS_MSG_SMT);
+ +		update_mds_branch_idle();
+ +		break;
+ +	case MDS_MITIGATION_OFF:
+ +		break;
+ +	}
+ +
+ +	switch (taa_mitigation) {
+ +	case TAA_MITIGATION_VERW:
+ +	case TAA_MITIGATION_UCODE_NEEDED:
+ +		if (sched_smt_active())
+ +			pr_warn_once(TAA_MSG_SMT);
+ +		break;
+ +	case TAA_MITIGATION_TSX_DISABLED:
+ +	case TAA_MITIGATION_OFF:
+ +		break;
+ +	}
+ +
+ +	switch (mmio_mitigation) {
+ +	case MMIO_MITIGATION_VERW:
+ +	case MMIO_MITIGATION_UCODE_NEEDED:
+ +		if (sched_smt_active())
+ +			pr_warn_once(MMIO_MSG_SMT);
+ +		break;
+ +	case MMIO_MITIGATION_OFF:
+ +		break;
+ +	}
+ +
+ +	mutex_unlock(&spec_ctrl_mutex);
+  }
+  
+ -/* Update x86_spec_ctrl_base in case SMT state changed. */
+ -static void update_stibp_strict(void)
+ +#ifdef CONFIG_DEBUG_FS
+ +/*
+ + * Provide a debugfs file to dump SPEC_CTRL MSRs of all the CPUs
+ + * Consecutive MSR values are collapsed together if they are the same.
+ + */
+ +static ssize_t spec_ctrl_msrs_read(struct file *file, char __user *user_buf,
+ +				   size_t count, loff_t *ppos)
+  {
+ -	u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+ +	int bufsiz = min(count, PAGE_SIZE);
+ +	int cpu, prev_cpu, len, cnt = 0;
+ +	u64 val, prev_val;
+ +	char *buf;
+  
+ -	if (sched_smt_active())
+ -		mask |= SPEC_CTRL_STIBP;
+ +	/*
+ +	 * The MSRs info should be small enough that the whole buffer is
+ +	 * copied out in one call. However, user space may read it again
+ +	 * to see if there is any data left. Rereading the cached SPEC_CTRL
+ +	 * MSR values may produce a different result causing corruption in
+ +	 * output data. So skipping the call if *ppos is not starting from 0.
+ +	 */
+ +	if (*ppos)
+ +		return 0;
+  
+ -	if (mask == x86_spec_ctrl_base)
+ -		return;
+ +	buf = kmalloc(bufsiz, GFP_KERNEL);
+ +	if (!buf)
+ +		return -ENOMEM;
+  
+ -	pr_info("Update user space SMT mitigation: STIBP %s\n",
+ -		mask & SPEC_CTRL_STIBP ? "always-on" : "off");
+ -	x86_spec_ctrl_base = mask;
+ -	on_each_cpu(update_stibp_msr, NULL, 1);
+ -}
+ +	for_each_possible_cpu(cpu) {
+ +		val = per_cpu(x86_spec_ctrl_current, cpu);
+  
+ -/* Update the static key controlling the evaluation of TIF_SPEC_IB */
+ -static void update_indir_branch_cond(void)
+ -{
+ -	if (sched_smt_active())
+ -		static_branch_enable(&switch_to_cond_stibp);
+ +		if (!cpu)
+ +			goto next;
+ +
+ +		if (val == prev_val)
+ +			continue;
+ +
+ +		if (prev_cpu == cpu - 1)
+ +			len = snprintf(buf + cnt, bufsiz - cnt, "CPU  %d: 0x%llx\n",
+ +				       prev_cpu, prev_val);
+ +		else
+ +			len = snprintf(buf + cnt, bufsiz - cnt, "CPUs %d-%d: 0x%llx\n",
+ +					prev_cpu, cpu - 1, prev_val);
+ +
+ +		cnt += len;
+ +		if (!len)
+ +			break;	/* Out of buffer */
+ +next:
+ +		prev_cpu = cpu;
+ +		prev_val = val;
+ +	}
+ +
+ +	if (prev_cpu == cpu - 1)
+ +		cnt += snprintf(buf + cnt, bufsiz - cnt, "CPU  %d: 0x%llx\n",
+ +			       prev_cpu, prev_val);
+  	else
+ -		static_branch_disable(&switch_to_cond_stibp);
+ +		cnt += snprintf(buf + cnt, bufsiz - cnt, "CPUs %d-%d: 0x%llx\n",
+ +				prev_cpu, cpu - 1, prev_val);
+ +
+ +	count = simple_read_from_buffer(user_buf, count, ppos, buf, cnt);
+ +	kfree(buf);
+ +	return count;
+  }
+  
+ -#undef pr_fmt
+ -#define pr_fmt(fmt) fmt
+ +static const struct file_operations fops_spec_ctrl = {
+ +	.read = spec_ctrl_msrs_read,
+ +	.llseek = default_llseek,
+ +};
+  
+ -/* Update the static key controlling the MDS CPU buffer clear in idle */
+ -static void update_mds_branch_idle(void)
+ +static int __init init_spec_ctrl_debugfs(void)
+  {
+ -	/*
+ -	 * Enable the idle clearing if SMT is active on CPUs which are
+ -	 * affected only by MSBDS and not any other MDS variant.
+ -	 *
+ -	 * The other variants cannot be mitigated when SMT is enabled, so
+ -	 * clearing the buffers on idle just to prevent the Store Buffer
+ -	 * repartitioning leak would be a window dressing exercise.
+ -	 */
+ -	if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
+ -		return;
+ -
+ -	if (sched_smt_active()) {
+ -		static_branch_enable(&cpu_buf_idle_clear);
+ -	} else if (mmio_mitigation == MMIO_MITIGATION_OFF ||
+ -		   (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {
+ -		static_branch_disable(&cpu_buf_idle_clear);
+ -	}
+ +	if (!debugfs_create_file("spec_ctrl_msrs", 0400, arch_debugfs_dir,
+ +				 NULL, &fops_spec_ctrl))
+ +		return -ENOMEM;
+ +	return 0;
+  }
+ +fs_initcall(init_spec_ctrl_debugfs);
+ +#endif
+  
+++=======
+++>>>>>>> 6449f5baf9c7 (x86/bugs: Move cpu_bugs_smt_update() down)
+  #undef pr_fmt
+  #define pr_fmt(fmt)	"Speculative Store Bypass: " fmt
+  
+* Unmerged path arch/x86/kernel/cpu/bugs.c