[PATCH 0/4] Add Support for AMD EPYC Zen 6 CPU Model

[PATCH 0/4] Add Support for AMD EPYC Zen 6 CPU Model

[Ben Cheatham]

This series adds support for AMD's upcoming EPYC Zen 6 CPU models
(EPYC-Venice). The first four patches add support for the EPYC-Venice
model while the last patch adds the actual model.

The EPYC-Venice model is based on the EPYC-Turin model feature set with
the following feature additions:

	ERAPS, TSC Adjustment, Shadow Stack, and SRSO_NO vulnerability fix

and support for the following instructions:

	AVX512 FP16, AVX512 IFMA, AVX NE-Convert, AVX VNNI Int8, and
	AVX512 BMM instructions

as well as new cache values.

Some of these features (ERAPS) were only just recently merged into the
Linux kernel. It's recommended to use a v7.0+ kernel to leverage the
full support of the model.

Amit Shah (1):
  target/i386: Add getting RAPSIZE for ERAPS enabled guests

Ben Cheatham (2):
  target/i386: Update RAPSIZE definition
  target/i386: Add EPYC-Venice CPU model

Nikunj A Dadhania (1):
  target/i386: Add AVX512 Bit Matrix Multiply (BMM) support

 target/i386/cpu.c | 152 +++++++++++++++++++++++++++++++++++++++++++++-
 target/i386/cpu.h |   9 ++-
 2 files changed, 156 insertions(+), 5 deletions(-)

base-commit: 10a9fa0065a3cd3dcf12e2eae6b8caaac6ecdec7
-- 
2.53.0

[PATCH 1/4] target/i386: Add AVX512 Bit Matrix Multiply (BMM) support

[Ben Cheatham]

From: Nikunj A Dadhania <nikunj@amd.com>

Add the AVX512 Bit Matrix Multiply feature flag at CPUID leaf
0x80000021_EAX[23], enabling guests to detect and use BMM instructions
for accelerated bit matrix multiply operations. Add the "avx512-bmm"
feature name to allow QEMU to expose this capability when available on
the host.

avx512-bmm: AVX512 Bit Matrix Multiply instruction

Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
Signed-off-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 8929a75c7c92..a85cc67700fa 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1434,7 +1434,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "auto-ibrs", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
-            "prefetchi", NULL, NULL, NULL,
+            "prefetchi", NULL, NULL, "avx512-bmm",
             "eraps", NULL, NULL, "sbpb",
             "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
         },
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 67e2ecf32517..e66333cd9c24 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1200,6 +1200,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
 /* Indicates support for IC prefetch */
 #define CPUID_8000_0021_EAX_PREFETCHI                    (1U << 20)
+/* AVX512 Bit Matrix Multiply (BMM) instruction support */
+#define CPUID_8000_0021_EAX_AVX512_BMM                   (1U << 23)
 /* Enhanced Return Address Predictor Scurity */
 #define CPUID_8000_0021_EAX_ERAPS                        (1U << 24)
 /* Selective Branch Predictor Barrier */
-- 
2.53.0

[PATCH 2/4] target/i386: Update RAPSIZE definition

[Ben Cheatham]

The RAPSIZE definition originally introduced in 9c07a7af5da:
"target/i386: Expose new feature bits in..." hard-coded the value
of the field to 0x8. While this value works for current CPUs, the
value may change in the future. Update the definition to be a bit-mask
instead of a hard-coded value for future-proofing.

The field is currently unused, so no functional change is intended.

Signed-off-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
---
 target/i386/cpu.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e66333cd9c24..ff63baa9dd23 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1214,10 +1214,11 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)
 
 /*
- * Return Address Predictor size. RapSize x 8 is the minimum number of
- * CALL instructions software needs to execute to flush the RAP.
+ * Return Address Predictor size. RapSize x Y is the minimum number of
+ * CALL instructions software needs to execute to flush the RAP, where
+ * Y is the value of CPUID_8000_0021.EBX[23:16].
  */
-#define CPUID_8000_0021_EBX_RAPSIZE    (8U << 16)
+#define CPUID_8000_0021_EBX_RAPSIZE    (0x00FF0000U)
 
 /* CPU is not vulnerable TSA SA-SQ attack */
 #define CPUID_8000_0021_ECX_TSA_SQ_NO  (1U << 1)
-- 
2.53.0

[PATCH 3/4] target/i386: Add getting RAPSIZE for ERAPS enabled guests

[Ben Cheatham]

From: Amit Shah <amit.shah@amd.com>

Newer AMD CPUs have the ERAPS (Enhanced Return Address Predictor
Security) cpuid bit. When this bit is available, the size of the RSB is
indicated in EBX bits 16:23 of the same function. Allow the guest to use
these features when kvm is enabled and are available on the host.

NOTE: The commit description is from a patch made by Amit while the
actual changes are a subset of that patch, hence my Co-developed-by.
Amit, let me know if the attribution looks good to you.

Signed-off-by: Amit Shah <amit.shah@amd.com>
Co-developed-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
Signed-off-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
---
 target/i386/cpu.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index a85cc67700fa..9342cc3ca4c6 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -9292,7 +9292,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
     case 0x80000021:
         *eax = *ebx = *ecx = *edx = 0;
         *eax = env->features[FEAT_8000_0021_EAX];
-        *ebx = env->features[FEAT_8000_0021_EBX];
+
+        if (kvm_enabled() && (*eax & CPUID_8000_0021_EAX_ERAPS)) {
+            *ebx |=
+              kvm_arch_get_supported_cpuid(cs->kvm_state, index, count, R_EBX) &
+              CPUID_8000_0021_EBX_RAPSIZE;
+        }
+
         *ecx = env->features[FEAT_8000_0021_ECX];
         break;
     case 0x80000022:
-- 
2.53.0

[PATCH 4/4] target/i386: Add EPYC-Venice CPU model

[Ben Cheatham]

Add support for AMD EPYC Zen 6 processors (EPYC-Venice). Add the
following new feature bits on top of the feature bits from the previous
generation EPYC model (Turin):

avx512_fp16		: AVX512 FP16 instructions support
avx_ifma		: AVX512 Integer Fused Mul-Add instructions support
avx_ne_convert	: AVX NE-CONVERT instructions support
avx_vnni_int8	: AVX VNNI INT8 instruction
avx512_bmm		: AVX512 Bit Matrix Multiply instruction
eraps			: Enhanced Return Address Prediction Security support
				  (see also: rapsize)
tsc_adjust		: Time Stamp Counter Adjustment support
cet_ss			: Shadow Stack support
srso_no			: Not susceptible to Speculative Return Stack Overflow

Signed-off-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
---
 target/i386/cpu.c | 142 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 142 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9342cc3ca4c6..e6f9f3dd3355 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3048,6 +3048,59 @@ static const CPUCaches epyc_turin_cache_info = {
     }
 };
 
+static const CPUCaches epyc_venice_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 48 * KiB,
+        .line_size = 64,
+        .associativity = 12,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 1 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 1024,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 64 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 65536,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    }
+};
 static const CPUCaches xeon_spr_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         /* CPUID 0x4.0x0.EAX */
@@ -7309,6 +7362,95 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             { /* end of list */ }
         }
     },
+    {
+        .name = "EPYC-Venice",
+        .level = 0xd,
+        .vendor = CPUID_VENDOR_AMD,
+        .family = 26,
+        .model = 80,
+        .stepping = 0,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
+            CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
+            CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
+            CPUID_EXT_PCID | CPUID_EXT_CX16 | CPUID_EXT_FMA |
+            CPUID_EXT_SSSE3 | CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ |
+            CPUID_EXT_SSE3,
+        .features[FEAT_1_EDX] =
+            CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
+            CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
+            CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
+            CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
+            CPUID_VME | CPUID_FP87,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_TSC_ADJUST |
+            CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
+            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
+            CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_AVX512F |
+            CPUID_7_0_EBX_AVX512DQ | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_AVX512IFMA |
+            CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB |
+            CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI |
+            CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+        .features[FEAT_7_0_ECX] =
+            CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
+            CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_CET_SHSTK |
+            CPUID_7_0_ECX_GFNI | CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+            CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_MOVDIRI |
+            CPUID_7_0_ECX_MOVDIR64B,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_AVX512_VP2INTERSECT |
+            CPUID_7_0_EDX_AVX512_FP16,
+        .features[FEAT_7_1_EAX] =
+            CPUID_7_1_EAX_AVX512_BF16 | CPUID_7_1_EAX_AVX_IFMA,
+        .features[FEAT_7_1_EDX] =
+            CPUID_7_1_EDX_AVX_VNNI_INT8 | CPUID_7_1_EDX_AVX_NE_CONVERT,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
+            CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
+            CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
+            CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
+            CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
+            CPUID_EXT2_SYSCALL,
+        .features[FEAT_8000_0007_EBX] =
+            CPUID_8000_0007_EBX_OVERFLOW_RECOV | CPUID_8000_0007_EBX_SUCCOR,
+        .features[FEAT_8000_0008_EBX] =
+            CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
+            CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
+            CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP |
+            CPUID_8000_0008_EBX_STIBP_ALWAYS_ON |
+            CPUID_8000_0008_EBX_AMD_SSBD | CPUID_8000_0008_EBX_AMD_PSFD,
+        .features[FEAT_8000_0021_EAX] =
+            CPUID_8000_0021_EAX_NO_NESTED_DATA_BP |
+            CPUID_8000_0021_EAX_FS_GS_BASE_NS |
+            CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING |
+            CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE |
+            CPUID_8000_0021_EAX_AUTO_IBRS | CPUID_8000_0021_EAX_PREFETCHI |
+            CPUID_8000_0021_EAX_AVX512_BMM | CPUID_8000_0021_EAX_ERAPS |
+            CPUID_8000_0021_EAX_SBPB | CPUID_8000_0021_EAX_IBPB_BRTYPE |
+            CPUID_8000_0021_EAX_SRSO_NO |
+            CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO,
+        .features[FEAT_8000_0022_EAX] =
+            CPUID_8000_0022_EAX_PERFMON_V2,
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
+        .features[FEAT_SVM] =
+            CPUID_SVM_NPT | CPUID_SVM_LBRV | CPUID_SVM_NRIPSAVE |
+            CPUID_SVM_TSCSCALE | CPUID_SVM_VMCBCLEAN | CPUID_SVM_FLUSHASID |
+            CPUID_SVM_PAUSEFILTER | CPUID_SVM_PFTHRESHOLD |
+            CPUID_SVM_V_VMSAVE_VMLOAD | CPUID_SVM_VGIF |
+            CPUID_SVM_VNMI | CPUID_SVM_SVME_ADDR_CHK,
+        .xlevel = 0x80000022,
+        .model_id = "AMD EPYC-Venice Processor",
+        .cache_info = &epyc_venice_cache_info,
+    },
 };
 
 /*
-- 
2.53.0

Re: [PATCH 3/4] target/i386: Add getting RAPSIZE for ERAPS enabled guests

[Shah, Amit]

On Tue, 2026-06-30 at 10:33 -0500, Ben Cheatham wrote:
> From: Amit Shah <amit.shah@amd.com>
> 
> Newer AMD CPUs have the ERAPS (Enhanced Return Address Predictor
> Security) cpuid bit. When this bit is available, the size of the RSB
> is
> indicated in EBX bits 16:23 of the same function. Allow the guest to
> use
> these features when kvm is enabled and are available on the host.
> 
> NOTE: The commit description is from a patch made by Amit while the
> actual changes are a subset of that patch, hence my Co-developed-by.
> Amit, let me know if the attribution looks good to you.

Looks good, thanks.  BTW you can move this blurb below the --- lines so
that it doesn't show up in the commit log.


> Signed-off-by: Amit Shah <amit.shah@amd.com>
> Co-developed-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
> Signed-off-by: Ben Cheatham <Benjamin.Cheatham@amd.com>
> ---
>  target/i386/cpu.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index a85cc67700fa..9342cc3ca4c6 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -9292,7 +9292,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t
> index, uint32_t count,
>      case 0x80000021:
>          *eax = *ebx = *ecx = *edx = 0;
>          *eax = env->features[FEAT_8000_0021_EAX];
> -        *ebx = env->features[FEAT_8000_0021_EBX];
> +
> +        if (kvm_enabled() && (*eax & CPUID_8000_0021_EAX_ERAPS)) {
> +            *ebx |=
> +              kvm_arch_get_supported_cpuid(cs->kvm_state, index,
> count, R_EBX) &
> +              CPUID_8000_0021_EBX_RAPSIZE;
> +        }
> +
>          *ecx = env->features[FEAT_8000_0021_ECX];
>          break;
>      case 0x80000022:

Re: [PATCH 3/4] target/i386: Add getting RAPSIZE for ERAPS enabled guests

[Cheatham, Benjamin]

On 6/30/2026 11:07 AM, Shah, Amit wrote:
> On Tue, 2026-06-30 at 10:33 -0500, Ben Cheatham wrote:
>> From: Amit Shah <amit.shah@amd.com>
>>
>> Newer AMD CPUs have the ERAPS (Enhanced Return Address Predictor
>> Security) cpuid bit. When this bit is available, the size of the RSB
>> is
>> indicated in EBX bits 16:23 of the same function. Allow the guest to
>> use
>> these features when kvm is enabled and are available on the host.
>>
>> NOTE: The commit description is from a patch made by Amit while the
>> actual changes are a subset of that patch, hence my Co-developed-by.
>> Amit, let me know if the attribution looks good to you.
> 
> Looks good, thanks.  BTW you can move this blurb below the --- lines so
> that it doesn't show up in the commit log.
> 

Good point, will do.

Thanks,
Ben