Re: [PATCH v5 18/20] KVM: x86: Expose APX sub-features to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] KVM fails to mask host CPUID values for leaf 0x29, silently exposing raw, unvirtualized host features and unknown future APX sub-features to userspace and the guest VM.
- [Medium] CPUID leaf 0x29 is an indexed leaf but is missing from `cpuid_function_is_indexed()`, causing KVM to return sub-leaf 0's data for all requested sub-leaves.
--

--- Patch [18]: [PATCH v5 18/20] KVM: x86: Expose APX sub-features to userspace ---
commit 86716b3a350e45c75f1b5a6c88353188cae56ce0
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Expose APX sub-features to userspace

This commit adds CPUID leaf 0x29 sub-leaf 0 to expose APX sub-features
(NCI, NDD, NF) to userspace if the APX foundation is available.

> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
[ ... ]
> @@ -1719,7 +1723,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
>  	}
>  	/* APX sub-features */
>  	case 0x29:
> -		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
> +		if (!kvm_cpu_cap_has(X86_FEATURE_APX))
> +			entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
>  		break;

[Severity: High]
If kvm_cpu_cap_has(X86_FEATURE_APX) is true, does this bypass capability
filtering and expose raw host CPUID values for leaf 0x29?

Looking at other leaves in __do_cpuid_func(), they typically use
cpuid_entry_override() or manually clear unused registers to apply the KVM
masks. Without this masking, it appears a userspace VMM querying
KVM_GET_SUPPORTED_CPUID for leaf 0x29 will receive unvirtualized hardware
features, which could then leak into the guest.

[Severity: Medium]
Does cpuid_function_is_indexed() in arch/x86/include/asm/cpuid/api.h also
need to be updated to include 0x29?

Since leaf 0x29 is an indexed leaf (as indicated by the newly added sub-leaf
0), missing it in cpuid_function_is_indexed() means KVM will not set
KVM_CPUID_FLAG_SIGNIFCANT_INDEX. 

As a result, if a guest queries an unsupported index like ECX=1,
kvm_find_cpuid_entry2() might incorrectly return the data for sub-leaf 0
instead of treating it as a distinct entry.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720171949.498680-1-chang.seok.bae@intel.com?part=18