Re: x86 CPUID mutable return values

[Christian Ludloff]

On Tue, Sep 22, 2026 at 5:24 PM Dave Hansen <dave.hansen@xxxxxxxxx> wrote:
> I'm all for documenting this stuff. I wish it was more open.

Alastair is working on it.

https://github.com/intel/SDM/issues/16

> But I do worry a bit that someone will read that, for example, "KL is immutable".
> $CUSTOMER starts depending on it. Then, $CPU_VENDOR decides that was a
> mistake and fixes it in a future implementation.

Most of the mutable values tend to remain stable.

HLE and RTM were needlessly complex outliers.

> > Based on some experiments, I think that VAES
> > does follow AES (i.e. is mutable as well), while
> > KL and PCLMUL do not (i.e. are immutable) –
> > so that's what I am seeking confirmation for.
>
> Are you OK with just checking a recent implementation or do you need a
> wider search of older implementations?

TGL would be interesting – KL did arrive back then.

NVL would be interesting – for the latest P+E – but
we probably have to settle for PTL for now.

> > PS: Should Linux boot check/fix that LOCK?
>
> I don't really feel a strong need to do it. I honestly don't know why
> the lock bit is even there. I'd randomly _guess_ that Intel's
> implementation was not certified for $THINGS and they got nervous and
> asked to have a chicken bit exposed for it just so it couldn't
> accidentally get used.

AES DISABLE+LOCK were originally added due to
import rules in some countries.

> But, for Linux, the kernel doesn't currently munging the disable or lock
> bits. If someone munges it with wrmsr(1), they get to keep the pieces
> just like any old wrmsr(1) user. I'm struggling to think of a scenario
> where being able to twiddle either of the bits could be useful to an
> attacker.

If LOCK=0 leads to someone setting DISABLE=1,
then things will get slow, or do who knows what in
software. But then... armed with WRMSR to begin
with, someone can do a lot more damage anyway.

> So I'm not sure it's worth prodding, even if we think it's got a funny value.

Yay. We gave it thought, and got us a record of it.

--
C.