[PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[Breno Leitao]

From: "Borislav Petkov (AMD)" <bp@alien8.de>

commit ddde4abaa0ecc8395e0fcfa3e92f65d481890cc8 upstream.

That cpuinfo_x86.x86_capability[] element was supposed to mirror CPUID flags
from CPUID_0x80000007_EBX but that leaf has still to this day only three bits
defined in it. So move those bits to scattered.c and free the capability
element for synthetic flags.

No functional changes.

[ leitao: Required on 6.18.y: the 6.18.61 backport of ae1d2082d93b
  ("x86/bugs: Adapt SRSO mitigation to Zen6") put BTB_CTX_ISOLATION in
  word 17, which here still mirrors CPUID 0x80000007 EBX. The flag is
  then falsely set on Zen3-5, and Zen5 silently loses its guest->host
  SRSO mitigation. ]

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 arch/x86/include/asm/cpufeature.h        | 2 +-
 arch/x86/include/asm/cpufeatures.h       | 5 ++++-
 arch/x86/kernel/cpu/common.c             | 8 ++------
 arch/x86/kernel/cpu/scattered.c          | 3 +++
 arch/x86/kvm/reverse_cpuid.h             | 1 -
 tools/arch/x86/include/asm/cpufeatures.h | 5 ++++-
 6 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 893cbca37fe99b..96acb669bed48b 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -30,7 +30,7 @@ enum cpuid_leafs
 	CPUID_6_EAX,
 	CPUID_8000_000A_EDX,
 	CPUID_7_ECX,
-	CPUID_8000_0007_EBX,
+	CPUID_LNX_6,
 	CPUID_7_EDX,
 	CPUID_8000_001F_EAX,
 	CPUID_8000_0021_EAX,
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index de7da218835e6b..7f909b771dbe84 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -407,9 +407,12 @@
 #define X86_FEATURE_ENQCMD		(16*32+29) /* "enqcmd" ENQCMD and ENQCMDS instructions */
 #define X86_FEATURE_SGX_LC		(16*32+30) /* "sgx_lc" Software Guard Extensions Launch Control */
 
-/* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
+/*
+ * Linux-defined word for use with scattered/synthetic bits.
+ */
 #define X86_FEATURE_OVERFLOW_RECOV	(17*32+ 0) /* "overflow_recov" MCA overflow recovery support */
 #define X86_FEATURE_SUCCOR		(17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
+
 #define X86_FEATURE_SMCA		(17*32+ 3) /* "smca" Scalable MCA */
 #define X86_FEATURE_BTB_CTX_ISOLATION	(17*32+ 4) /* AMD: Branch predictions contexts isolated */
 
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b0de3aabcd791d..3c2a748f684dbc 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1025,12 +1025,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
 		c->x86_capability[CPUID_8000_0001_EDX] = edx;
 	}
 
-	if (c->extended_cpuid_level >= 0x80000007) {
-		cpuid(0x80000007, &eax, &ebx, &ecx, &edx);
-
-		c->x86_capability[CPUID_8000_0007_EBX] = ebx;
-		c->x86_power = edx;
-	}
+	if (c->extended_cpuid_level >= 0x80000007)
+		c->x86_power = cpuid_edx(0x80000007);
 
 	if (c->extended_cpuid_level >= 0x80000008) {
 		cpuid(0x80000008, &eax, &ebx, &ecx, &edx);
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index 083403886da225..2a1a1513054989 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -44,6 +44,9 @@ static const struct cpuid_bit cpuid_bits[] = {
 	{ X86_FEATURE_SGX1,			CPUID_EAX,  0, 0x00000012, 0 },
 	{ X86_FEATURE_SGX2,			CPUID_EAX,  1, 0x00000012, 0 },
 	{ X86_FEATURE_SGX_EDECCSSA,		CPUID_EAX, 11, 0x00000012, 0 },
+	{ X86_FEATURE_OVERFLOW_RECOV,		CPUID_EBX,  0, 0x80000007, 0 },
+	{ X86_FEATURE_SUCCOR,			CPUID_EBX,  1, 0x80000007, 0 },
+	{ X86_FEATURE_SMCA,			CPUID_EBX,  3, 0x80000007, 0 },
 	{ X86_FEATURE_HW_PSTATE,		CPUID_EDX,  7, 0x80000007, 0 },
 	{ X86_FEATURE_CPB,			CPUID_EDX,  9, 0x80000007, 0 },
 	{ X86_FEATURE_PROC_FEEDBACK,		CPUID_EDX, 11, 0x80000007, 0 },
diff --git a/arch/x86/kvm/reverse_cpuid.h b/arch/x86/kvm/reverse_cpuid.h
index dcd8ed7c5ed4c7..8ff2a37016d6ce 100644
--- a/arch/x86/kvm/reverse_cpuid.h
+++ b/arch/x86/kvm/reverse_cpuid.h
@@ -79,7 +79,6 @@ static const struct cpuid_reg reverse_cpuid[] = {
 	[CPUID_6_EAX]         = {         6, 0, CPUID_EAX},
 	[CPUID_8000_000A_EDX] = {0x8000000a, 0, CPUID_EDX},
 	[CPUID_7_ECX]         = {         7, 0, CPUID_ECX},
-	[CPUID_8000_0007_EBX] = {0x80000007, 0, CPUID_EBX},
 	[CPUID_7_EDX]         = {         7, 0, CPUID_EDX},
 	[CPUID_7_1_EAX]       = {         7, 1, CPUID_EAX},
 	[CPUID_12_EAX]        = {0x00000012, 0, CPUID_EAX},
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 4091a776e37aae..80b68f4726e7bf 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -407,9 +407,12 @@
 #define X86_FEATURE_ENQCMD		(16*32+29) /* "enqcmd" ENQCMD and ENQCMDS instructions */
 #define X86_FEATURE_SGX_LC		(16*32+30) /* "sgx_lc" Software Guard Extensions Launch Control */
 
-/* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
+/*
+ * Linux-defined word for use with scattered/synthetic bits.
+ */
 #define X86_FEATURE_OVERFLOW_RECOV	(17*32+ 0) /* "overflow_recov" MCA overflow recovery support */
 #define X86_FEATURE_SUCCOR		(17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
+
 #define X86_FEATURE_SMCA		(17*32+ 3) /* "smca" Scalable MCA */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */

---
base-commit: 1cdda838e8475edf89b73ff0cc952005dd0b1fa7
change-id: 20261111-stabe_srso-98cf764d4d66

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[Borislav Petkov]

On Wed, Nov 11, 2026 at 08:06:21AM -0800, Breno Leitao wrote:
> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> 
> commit ddde4abaa0ecc8395e0fcfa3e92f65d481890cc8 upstream.
> 
> That cpuinfo_x86.x86_capability[] element was supposed to mirror CPUID flags
> from CPUID_0x80000007_EBX but that leaf has still to this day only three bits
> defined in it. So move those bits to scattered.c and free the capability
> element for synthetic flags.
> 
> No functional changes.
> 
> [ leitao: Required on 6.18.y: the 6.18.61 backport of ae1d2082d93b
>   ("x86/bugs: Adapt SRSO mitigation to Zen6") put BTB_CTX_ISOLATION in
>   word 17, which here still mirrors CPUID 0x80000007 EBX. The flag is
>   then falsely set on Zen3-5, and Zen5 silently loses its guest->host
>   SRSO mitigation. ]

Good catch, dang. That's nasty one.

Thanks!

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[H. Peter Anvin]

Still, I have to wonder if it really makes sense to fold these leaves 
like this, since they are going to be populated soon. Surely we're not 
that short of bits?

	-hpa


On 2026-11-11 20:57, Borislav Petkov wrote:
> On Wed, Nov 11, 2026 at 08:06:21AM -0800, Breno Leitao wrote:
>> From: "Borislav Petkov (AMD)" <bp@alien8.de>
>>
>> commit ddde4abaa0ecc8395e0fcfa3e92f65d481890cc8 upstream.
>>
>> That cpuinfo_x86.x86_capability[] element was supposed to mirror CPUID flags
>> from CPUID_0x80000007_EBX but that leaf has still to this day only three bits
>> defined in it. So move those bits to scattered.c and free the capability
>> element for synthetic flags.
>>
>> No functional changes.
>>
>> [ leitao: Required on 6.18.y: the 6.18.61 backport of ae1d2082d93b
>>    ("x86/bugs: Adapt SRSO mitigation to Zen6") put BTB_CTX_ISOLATION in
>>    word 17, which here still mirrors CPUID 0x80000007 EBX. The flag is
>>    then falsely set on Zen3-5, and Zen5 silently loses its guest->host
>>    SRSO mitigation. ]
> 
> Good catch, dang. That's nasty one.
> 
> Thanks!
> 

Re: [PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[Borislav Petkov]

On November 12, 2026 10:13:31 PM UTC, "H. Peter Anvin" <hpa@zytor.com> wrote:
>Still, I have to wonder if it really makes sense to fold these leaves like this, since they are going to be populated soon. Surely we're not that short of bits?
>

If you mean the leaves in scattered.c, I'm thinking the moment a leaf appears there with half of its bits, it'll get moved to its own separate leaf.

-- 
Small device. Typos and formatting crap

Re: [PATCH 6.18.y] x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific

[Thomas Gleixner]

On Thu, Nov 12 2026 at 22:23, Borislav Petkov wrote:
> On November 12, 2026 10:13:31 PM UTC, "H. Peter Anvin" <hpa@zytor.com> wrote:
>> Still, I have to wonder if it really makes sense to fold these leaves
>> like this, since they are going to be populated soon. Surely we're not
>> that short of bits?
>>
>
> If you mean the leaves in scattered.c, I'm thinking the moment a leaf
> appears there with half of its bits, it'll get moved to its own
> separate leaf.

Crap.

Even if a new leaf has only _ONE_ bit defined then it's a new leaf. This
whole "save space" nonsense has been source of a gazillion of subtle
bugs in the past and we just continue to "fix" them instead of actually
tackling the underlying problem.

Linux specific leafs want to be in a space which is reserved by
hardware for software purposes and not arbitrarily hacked into "holes".

Hardware defined leafs have to be represented by a proper entry even if
there is only one relevant bit in a leaf.

That's what I have proposed long ago and the CPUID database project

       https://x86-cpuid.org/

laid the ground for changing this whole mess to something structured and
well defined.

Some initial changes have made their way into mainline, but then Intel
stopped funding it and AMD has no money for that either...

So this will trickle along for another two decades with the same bugs
repeating themself over and over. WTF?

Thanks,

        tglx