linux-kernel - Re: [x86/cpuid] Question regarding historic leaf 0x80000000 code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d4fcfd91-cc92-4b3c-9dd2-56ecd754cecc@citrix.com>
Date: Thu, 20 Mar 2025 19:42:28 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: "Ahmed S. Darwish" <darwi@...utronix.de>, "H. Peter Anvin" <hpa@...or.com>
Cc: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 John Ogness <john.ogness@...utronix.de>, x86@...nel.org,
 x86-cpuid@...ts.linux.dev, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [x86/cpuid] Question regarding historic leaf 0x80000000 code

On 20/03/2025 7:33 pm, Ahmed S. Darwish wrote:
> Hi hpa,
>
> As you probably know by now, we're working on a centralized "CPUID table"
> data model, on top of the cleanups at:
>
>     https://lore.kernel.org/x86-cpuid/20250304085152.51092-1-darwi@linutronix.de
>     https://lore.kernel.org/x86-cpuid/20250319122137.4004-1-darwi@linutronix.de
>     https://lore.kernel.org/x86-cpuid/20250312143738.458507-1-darwi@linutronix.de
>
> The idea is to remove all the direct CPUID queries from the x86 code, and
> access a pre-filled table instead (with caveats outside the scope of this
> question.)
>
> While changing the CPUID queries one by one, I've stumbled with:
>
>     => arch/x86/kernel/cpu/common.c
>     void get_cpu_cap(struct cpuinfo_x86 *c)
>     {
> 	...
> 	/* AMD-defined flags: level 0x80000001 */
> 	eax = cpuid_eax(0x80000000);
> 	c->extended_cpuid_level = eax;
>
> 	if ((eax & 0xffff0000) == 0x80000000) {
> 		if (eax >= 0x80000001) {
> 			cpuid(0x80000001, &eax, &ebx, &ecx, &edx);
>
> 			c->x86_capability[CPUID_8000_0001_ECX] = ecx;
> 			c->x86_capability[CPUID_8000_0001_EDX] = edx;
> 		}
> 	}
> 	...
>     }
>
> You've contributed that snippet here:
>
>     https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?h=2.4.0-test11pre5&id=67ad24e6d39c3
>
> Do you remember what was the rationale for the "if (eax & 0xffff0000) ==
> 0x80000000" check?
>
> You've also contriubted a similar check to head_32.S:
>
>     https://lore.kernel.org/r/1258154897-6770-2-git-send-email-hpa@zytor.com
>
>     /* Check if extended functions are implemented */
>     movl $0x80000000, %eax
>     cpuid
>     /* Value must be in the range 0x80000001 to 0x8000ffff */
>     subl $0x80000001, %eax
>     cmpl $(0x8000ffff-0x80000001), %eax
>     ja .Lenable_paging
>
> So I would assume, it would be safe to have a similar check in our
> centralized "system CPUID table" scanner.
>
> In all cases, if you know more details, it would be great to know, so
> that I add it in the centralized CPUID table patch queue changelog (in a
> separate patch.)

The problem is that for an out-of-range leaf, Intel returns the data
from the maximum in-range leaf, rather than zeroes.

On pre-AMD64-capable Intel CPUs, you'll get what amounts to junk in a
query for leaf 0x80000000, where it's probably leaf 5 or so.

Checking for the upper half of the output matching the input is a way of
distinguishing Intel behaviour from all the other vendors.

~Andrew