Re: [PATCH v6 18/20] KVM: x86: Expose APX sub-features to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM fails to mask host CPUID leaf 0x29 with its virtualization capabilities, unconditionally exposing future host hardware features to userspace.
--

--- Patch [18]: [PATCH v6 18/20] KVM: x86: Expose APX sub-features to userspace ---
commit 858481784d49e0b77ae999aa39a6b6f4ada7e521
Author: Chang S. Bae <chang.seok.bae@intel.com>
Subject: KVM: x86: Expose APX sub-features to userspace

This commit adds CPUID leaf 0x29 sub-leaf 0 to expose APX sub-features
(NCI, NDD, NF) to userspace if the APX foundation is available.

> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c

[ ... ]

> @@ -1719,7 +1723,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
>  	}
>  	/* APX sub-features */
>  	case 0x29:
> -		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
> +		if (!kvm_cpu_cap_has(X86_FEATURE_APX))
> +			entry->eax = entry->ebx = entry->ecx = entry->edx = 0;

[Severity: High]
If the host supports X86_FEATURE_APX, does __do_cpuid_func() bypass masking
the KVM CPU capabilities for leaf 0x29?

When kvm_cpu_cap_has(X86_FEATURE_APX) is true, this path breaks out without
applying cpuid_entry_override(entry, CPUID_29_0_EBX) or clearing the unused
registers (eax, ecx, edx).

Could this leak unmasked host CPUID values for leaf 0x29 directly to
userspace when KVM_GET_SUPPORTED_CPUID is called? Exposing unvetted
hardware features might break guest live migration to older hosts.

>  		break;
>  	case KVM_CPUID_SIGNATURE: {
>  		const u32 *sigptr = (const u32 *)KVM_SIGNATURE;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729191656.598771-1-chang.seok.bae@intel.com?part=18