x86/cpu: Refactor identify_cpu()

PATCH Superseded Ihor Solodrai 3 participants 11 messages Aug 14 – Sep 15

Subsystems (3)

Memory management x86 BPF

lore

Share & tools

lore

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #0 lore raw

v2 cover x86/cpu: Refactor identify_cpu()

This series refactors identify_cpu() machinery on x86 and then implements a fix for a bug when cpu capabilities are temporarily cleared within an interruptable window. For more details and discussion see the relevant bug report [1] and patch #5.

Signed-off-by Ihor Solodrai <[email protected]>

[1] https://lore.kernel.org/bpf/[email protected]/

---

v1->v2:
* Rewrite commit messages to fit more conventional structure (Boris)
* Drop identify_cpu_32() helper, it's unnecessary (Boris)
* New patch (#2): now early_identify_cpu() resets boot_cpu_data through init_cpu_info() as well
* The boot CPU reset is now skipped on 32-bit too (sashiko)

v1: https://lore.kernel.org/bpf/[email protected]/

---

Ihor Solodrai (5):
x86/cpu: Factor init_cpu_info() out of identify_cpu() x86/cpu: Initialize boot CPU cpuinfo defaults early x86/cpu: Inline generic_identify() into identify_cpu() x86/cpu: Move 32-bit SEP setup into identify_cpu() x86/cpu: Don't transiently clear the boot CPU's capabilities

 arch/x86/kernel/cpu/common.c | 92 +++++++++++++++++-------------------
 1 file changed, 44 insertions(+), 48 deletions(-)

base-commit: db2ddb87143519e20a95aa36c60b36107b736a58

Signature · 1 line

2.55.0

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #1 lore raw

PATCH v2 1/5 x86/cpu: Factor init_cpu_info() out of identify_cpu()

identify_cpu() unconditionally resets the struct cpuinfo_x86 fields to their default values and clears the capability arrays with memset() before rescanning the CPU to fill it in again.

However the boot CPU capabilities have already been scanned by early_identify_cpu(), with interrupts disabled.

Introduce init_cpu_info() helper in preparation for letting the callers decide whether the reset is needed.

early_identify_cpu() starts using the helper in the next patch.

No functional changes.

Signed-off-by Ihor Solodrai <[email protected]>

---
 arch/x86/kernel/cpu/common.c | 51 ++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 23 deletions(-)

arch/x86/kernel/cpu/common.c +28 ~~-23~~

index a3df21d26460..bb4525523222 100644
@@ -1772,6 +1772,32 @@ static void __init cpu_parse_early_param(void)
 	}
 }
 
+static void init_cpu_info(struct cpuinfo_x86 *c)
+{
+	c->x86_cache_size = 0;
+	c->x86_vendor = X86_VENDOR_UNKNOWN;
+	c->x86_model = c->x86_stepping = 0;	/* So far unknown... */
+	c->x86_vendor_id[0] = '\0'; /* Unset */
+	c->x86_model_id[0] = '\0';  /* Unset */
+#ifdef CONFIG_X86_64
+	c->x86_clflush_size = 64;
+	c->x86_phys_bits = 36;
+	c->x86_virt_bits = 48;
+#else
+	c->cpuid_level = -1;	/* CPUID not detected */
+	c->x86_clflush_size = 32;
+	c->x86_phys_bits = 32;
+	c->x86_virt_bits = 32;
+#endif
+	c->x86_cache_alignment = c->x86_clflush_size;
+	memset(&c->x86_capability, 0, sizeof(c->x86_capability));
+	memset(&c->cpuid, 0, sizeof(c->cpuid));
+#ifdef CONFIG_X86_VMX_FEATURE_NAMES
+	memset(&c->vmx_capability, 0, sizeof(c->vmx_capability));
+#endif
+	c->extended_cpuid_level = 0;
+}
+
 /*
  * Do minimum CPU detection early.
  * Fields really needed: vendor, cpuid_level, family, model, mask,

@@ -1956,8 +1982,6 @@ void check_null_seg_clears_base(struct cpuinfo_x86 *c)
 
 static void generic_identify(struct cpuinfo_x86 *c)
 {
-	c->extended_cpuid_level = 0;
-
 	if (!cpuid_feature())
 		identify_cpu_without_cpuid(c);

@@ -2001,27 +2025,8 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 	int i;
 
 	c->loops_per_jiffy = loops_per_jiffy;
-	c->x86_cache_size = 0;
-	c->x86_vendor = X86_VENDOR_UNKNOWN;
-	c->x86_model = c->x86_stepping = 0;	/* So far unknown... */
-	c->x86_vendor_id[0] = '\0'; /* Unset */
-	c->x86_model_id[0] = '\0';  /* Unset */
-#ifdef CONFIG_X86_64
-	c->x86_clflush_size = 64;
-	c->x86_phys_bits = 36;
-	c->x86_virt_bits = 48;
-#else
-	c->cpuid_level = -1;	/* CPUID not detected */
-	c->x86_clflush_size = 32;
-	c->x86_phys_bits = 32;
-	c->x86_virt_bits = 32;
-#endif
-	c->x86_cache_alignment = c->x86_clflush_size;
-	memset(&c->x86_capability, 0, sizeof(c->x86_capability));
-	memset(&c->cpuid, 0, sizeof(c->cpuid));
-#ifdef CONFIG_X86_VMX_FEATURE_NAMES
-	memset(&c->vmx_capability, 0, sizeof(c->vmx_capability));
-#endif
+
+	init_cpu_info(c);
 
 	generic_identify(c);

Signature · 1 line

2.55.0

Borislav Petkov

maintainer

2026-09-10 02:33 UTC #2 lore raw

Re: [PATCH v2 1/5] x86/cpu: Factor init_cpu_info() out of identify_cpu()

Quoted 11 lines · Ihor Solodrai

identify_cpu() unconditionally resets the struct cpuinfo_x86 fields to their default values and clears the capability arrays with memset() before rescanning the CPU to fill it in again.
However the boot CPU capabilities have already been scanned by early_identify_cpu(), with interrupts disabled.
Introduce init_cpu_info() helper in preparation for letting the callers decide whether the reset is needed.
early_identify_cpu() starts using the helper in the next patch.

No need for that sentence. I'll zap it.

Signature · 4 lines

Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #3 lore raw

PATCH v2 2/5 x86/cpu: Initialize boot CPU cpuinfo defaults early

In reply to Ihor Solodrai

early_identify_cpu() clears the capability array, the CPUID table and extended_cpuid_level, but the architectural defaults for the rest of struct cpuinfo_x86 are set only later, in identify_cpu().

On x86_64 x86_clflush_size defaults to 64. Until that default is applied it reads as zero, which get_cpu_address_sizes() interprets as "not enumerated" and replaces with 32. So on a CPU which does not enumerate CLFLUSH the boot CPU runs with an x86_clflush_size and an x86_cache_alignment of 32 until identify_cpu() resets them to 64.

Use the same defaults from the start, so that the boot CPU does not depend on a later reset to end up with the right ones.

The values the boot CPU ends up with do not change. Early users of cache_line_size() on a CPU which does not enumerate CLFLUSH now see the architectural 64 instead of the 32 fallback, which is what they should have been seeing all along.

This change comes before the last patch because that one removes the
reset: without the defaults established here the boot CPU would be left at 32 instead of 64 on an x86_64 CPU which does not enumerate CLFLUSH.

Signed-off-by Ihor Solodrai <[email protected]>

---
 arch/x86/kernel/cpu/common.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

arch/x86/kernel/cpu/common.c +3 -4

index bb4525523222..f43584c8aeab 100644
@@ -1802,16 +1802,15 @@ static void init_cpu_info(struct cpuinfo_x86 *c)
  * Do minimum CPU detection early.
  * Fields really needed: vendor, cpuid_level, family, model, mask,
  * cache alignment.
- * The others are not touched to avoid unwanted side effects.
+ * The others are reset to their defaults here and only filled in later,
+ * by identify_cpu().
  *
  * WARNING: this function is only called on the boot CPU.  Don't add code
  * here that is supposed to run on all CPUs.
  */
 static void __init early_identify_cpu(struct cpuinfo_x86 *c)
 {
-	memset(&c->x86_capability, 0, sizeof(c->x86_capability));
-	memset(&c->cpuid, 0, sizeof(c->cpuid));
-	c->extended_cpuid_level = 0;
+	init_cpu_info(c);
 
 	if (!cpuid_feature())
 		identify_cpu_without_cpuid(c);

Signature · 1 line

2.55.0

Borislav Petkov

maintainer

2026-09-15 02:31 UTC #4 lore raw

Re: [PATCH v2 2/5] x86/cpu: Initialize boot CPU cpuinfo defaults early

Quoted 3 lines · Ihor Solodrai

early_identify_cpu() clears the capability array, the CPUID table and extended_cpuid_level, but the architectural defaults for the rest of struct cpuinfo_x86 are set only later, in identify_cpu().

And I would've stopped here. I don't think we care too much about a CPU which doesn't enumerate CLFLUSH. Or is there an aspect I am missing.

I mean, you can say something along the lines that now things like ->x86_cache_alignment are more correct but I don't think you need to go that much into detail.

Quoted 14 lines

On x86_64 x86_clflush_size defaults to 64. Until that default is applied it reads as zero, which get_cpu_address_sizes() interprets as "not enumerated" and replaces with 32. So on a CPU which does not enumerate CLFLUSH the boot CPU runs with an x86_clflush_size and an x86_cache_alignment of 32 until identify_cpu() resets them to 64.
Use the same defaults from the start, so that the boot CPU does not depend on a later reset to end up with the right ones.
The values the boot CPU ends up with do not change. Early users of cache_line_size() on a CPU which does not enumerate CLFLUSH now see the architectural 64 instead of the 32 fallback, which is what they should have been seeing all along.

Quoted 4 lines

This change comes before the last patch because that one removes the
reset: without the defaults established here the boot CPU would be left at 32 instead of 64 on an x86_64 CPU which does not enumerate CLFLUSH.

This paragraph goes...

Quoted 3 lines

Signed-off-by Ihor Solodrai <[email protected]>
---

... here, after the "---" delimiter as it doesn't really belong in the commit message.

Thx.

Signature · 4 lines

Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Ihor Solodrai

author reviewer

2026-09-15 16:34 UTC #5 lore raw

Re: [PATCH v2 2/5] x86/cpu: Initialize boot CPU cpuinfo defaults early

Quoted 11 lines · Borislav Petkov

Quoted 3 lines · Ihor Solodrai
early_identify_cpu() clears the capability array, the CPUID table and extended_cpuid_level, but the architectural defaults for the rest of struct cpuinfo_x86 are set only later, in identify_cpu().
And I would've stopped here. I don't think we care too much about a CPU which doesn't enumerate CLFLUSH. Or is there an aspect I am missing.
I mean, you can say something along the lines that now things like ->x86_cache_alignment are more correct but I don't think you need to go that much into detail.

Ok. I don't think you're missing anything.

Should I respin with fixed up messages?

Quoted 3 lines

Quoted 2 lines
[...]

Borislav Petkov

maintainer

2026-09-15 23:45 UTC #6 lore raw

Re: [PATCH v2 2/5] x86/cpu: Initialize boot CPU cpuinfo defaults early

Quoted 1 line · Ihor Solodrai

Should I respin with fixed up messages?

Yes please.

Thx.

Signature · 4 lines

Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #7 lore raw

PATCH v2 3/5 x86/cpu: Inline generic_identify() into identify_cpu()

In reply to Ihor Solodrai

generic_identify() has exactly one call site: at the top of identify_cpu(). Fold it into identify_cpu() so that a single function does the job for both the boot CPU and the secondary CPUs.

While at it, fix up both copies of the Cyrix comment.

No functional changes.

Signed-off-by Ihor Solodrai <[email protected]>

---
 arch/x86/kernel/cpu/common.c | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

arch/x86/kernel/cpu/common.c +14 ~~-18~~

index f43584c8aeab..08c4a0162581 100644
@@ -1815,7 +1815,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
 	if (!cpuid_feature())
 		identify_cpu_without_cpuid(c);
 
-	/* cyrix could have cpuid enabled via c_identify()*/
+	/* Cyrix could have CPUID enabled via c_identify(). */
 	if (cpuid_feature()) {
 		cpuid_scan_cpu(c);
 		cpu_detect(c);

@@ -1979,14 +1979,23 @@ void check_null_seg_clears_base(struct cpuinfo_x86 *c)
 	set_cpu_bug(c, X86_BUG_NULL_SEG);
 }
 
-static void generic_identify(struct cpuinfo_x86 *c)
+/*
+ * This does the hard work of actually picking apart the CPU stuff...
+ */
+static void identify_cpu(struct cpuinfo_x86 *c)
 {
+	int i;
+
+	c->loops_per_jiffy = loops_per_jiffy;
+
+	init_cpu_info(c);
+
 	if (!cpuid_feature())
 		identify_cpu_without_cpuid(c);
 
-	/* cyrix could have cpuid enabled via c_identify()*/
+	/* Cyrix could have CPUID enabled via c_identify(). */
 	if (!cpuid_feature())
-		return;
+		goto no_cpuid;
 
 	cpuid_scan_cpu(c);
 	cpu_detect(c);

@@ -2014,21 +2023,8 @@ static void generic_identify(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_32
 	set_cpu_bug(c, X86_BUG_ESPFIX);
 #endif
-}
-
-/*
- * This does the hard work of actually picking apart the CPU stuff...
- */
-static void identify_cpu(struct cpuinfo_x86 *c)
-{
-	int i;
-
-	c->loops_per_jiffy = loops_per_jiffy;
-
-	init_cpu_info(c);
-
-	generic_identify(c);
 
+no_cpuid:
 	cpu_parse_topology(c);
 
 	if (this_cpu->c_identify)

Signature · 1 line

2.55.0

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #8 lore raw

PATCH v2 4/5 x86/cpu: Move 32-bit SEP setup into identify_cpu()

In reply to Ihor Solodrai

identify_boot_cpu() and identify_secondary_cpu() both call enable_sep_cpu() under CONFIG_X86_32 immediately after identify_cpu().

Do it once and drop the ifdefs while at it.

No functional changes.

Signed-off-by Ihor Solodrai <[email protected]>

---
 arch/x86/kernel/cpu/common.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

arch/x86/kernel/cpu/common.c +3 -6

index 08c4a0162581..671a430994ca 100644
@@ -2116,6 +2116,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 	mcheck_cpu_init(c);
 
 	numa_add_cpu(smp_processor_id());
+
+	if (IS_ENABLED(CONFIG_X86_32))
+		enable_sep_cpu();
 }
 
 /*

@@ -2153,9 +2156,6 @@ static __init void identify_boot_cpu(void)
 	identify_cpu(&boot_cpu_data);
 	if (HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT))
 		pr_info("CET detected: Indirect Branch Tracking enabled\n");
-#ifdef CONFIG_X86_32
-	enable_sep_cpu();
-#endif
 	cpu_detect_tlb(&boot_cpu_data);
 	setup_cr_pinning();

@@ -2175,9 +2175,6 @@ void identify_secondary_cpu(unsigned int cpu)
 	c->cpu_index = cpu;
 
 	identify_cpu(c);
-#ifdef CONFIG_X86_32
-	enable_sep_cpu();
-#endif
 	x86_spec_ctrl_setup_ap();
 	update_srbds_msr();
 	if (boot_cpu_has_bug(X86_BUG_GDS))

Signature · 1 line

2.55.0

Nikolay Borisov

Reviewed-by on v2 4/5

2026-08-17 12:14 UTC #9 lore raw

Re: [PATCH v2 4/5] x86/cpu: Move 32-bit SEP setup into identify_cpu()

Quoted 8 lines · Ihor Solodrai

identify_boot_cpu() and identify_secondary_cpu() both call enable_sep_cpu() under CONFIG_X86_32 immediately after identify_cpu().
Do it once and drop the ifdefs while at it.
No functional changes.
Signed-off-by Ihor Solodrai <[email protected]>

Reviewed-by Nikolay Borisov <[email protected]>

Ihor Solodrai

author reviewer

2026-08-14 23:52 UTC #10 lore raw

PATCH v2 5/5 x86/cpu: Don't transiently clear the boot CPU's capabilities

In reply to Ihor Solodrai

On the boot CPU identify_cpu() runs from arch_cpu_finalize_init(), with interrupts enabled and before alternatives are patched. So cpu_feature_enabled() still evaluates against boot_cpu_data.

identify_cpu() rebuilds c->x86_capability from scratch: the reset zeroes the array and the CPUID rescan fills it in again. An interrupt delivered in that window finds X86_FEATURE_LA57 clear in boot_cpu_data, so pgtable_l5_enabled() is false and KASAN checks a 5-level address against the 4-level addressability limit. The result is a bogus "wild-memory-access" report, and under kasan_multi_shot a report storm that wedges the boot.

The boot CPU has already been scanned by early_identify_cpu(), with interrupts disabled, and its capabilities cannot have changed since. Reset only the CPUs which have not been scanned yet.

32-bit gets the same treatment: the window is the same, and any feature bit evaluated from interrupt context while it is open reads as clear. Its no-CPUID cpuid_level default now comes from early_identify_cpu(), and nothing writes cpuid_level again unless CPUID is there to be read.

The window is as old as identify_cpu() rebuilding the capabilities. Commit 39b9552281ab ("x86/mm: Optimize boot-time paging mode switching cost") merely let KASAN notice it by making pgtable_l5_enabled() read the feature bit. So no Fixes: tag.

Closes https://lore.kernel.org/bpf/[email protected]/ open here

Signed-off-by Ihor Solodrai <[email protected]>

---
 arch/x86/kernel/cpu/common.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

arch/x86/kernel/cpu/common.c +1 -2

index 671a430994ca..e0c70a2510af 100644
@@ -1988,8 +1988,6 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 
 	c->loops_per_jiffy = loops_per_jiffy;
 
-	init_cpu_info(c);
-
 	if (!cpuid_feature())
 		identify_cpu_without_cpuid(c);

@@ -2174,6 +2172,7 @@ void identify_secondary_cpu(unsigned int cpu)
 		*c = boot_cpu_data;
 	c->cpu_index = cpu;
 
+	init_cpu_info(c);
 	identify_cpu(c);
 	x86_spec_ctrl_setup_ap();
 	update_srbds_msr();

Signature · 1 line

2.55.0