Re: [PATCH v6 16/20] KVM: x86: Add APX to supported XCR0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Premature exposure of APX XSTATE support to userspace via CPUID leaf 0xD.
--

--- Patch [16]: [PATCH v6 16/20] KVM: x86: Add APX to supported XCR0 ---
commit 1240d82e8b8dccfbe1fa4527616e2e4b0d49ebec
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Add APX to supported XCR0

This commit modifies KVM to include the APX state bit in its supported XCR0
capabilities when the host has APX enabled. This is done conditionally
based on CONFIG_KVM_APX.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 266d7a02855bb..48f8a2d699879 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7082,6 +7082,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
>  		kvm_host.xcr0 = xgetbv(XCR_XFEATURE_ENABLED_MASK);
>  		kvm_caps.supported_xcr0 = kvm_host.xcr0 & KVM_SUPPORTED_XCR0;
> +		if (IS_ENABLED(CONFIG_KVM_APX))
> +			kvm_caps.supported_xcr0 |= kvm_host.xcr0 & XFEATURE_MASK_APX;

[Severity: Medium]
The commit notes mention separating this out from userspace exposure, but
doesn't adding this flag to kvm_caps.supported_xcr0 directly expose APX to
userspace via KVM_GET_SUPPORTED_CPUID for leaf 0xD?

If userspace tools pass this leaf to the guest, would this allow the guest to
discover and enable APX state saving via XSETBV without standard capability
gating? This seems to conflict with KVM's expectation that new guest-visible
features default off and remain enumerable through standard interfaces.

>  	}
>  
>  	if (boot_cpu_has(X86_FEATURE_XSAVES)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729191656.598771-1-chang.seok.bae@intel.com?part=16