Re: [PATCH v7 18/20] KVM: x86: Expose APX sub-features to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM exposes unmasked host APX sub-features and leaks raw host CPUID state to the guest by failing to apply the capability mask for leaf 0x29.
--

commit c301f6e3ae94455385fa1906a5a873f104314430
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Expose APX sub-features to userspace
    
Add CPUID leaf 0x29 sub-leaf 0 to expose these APX sub-features, if the
APX foundation is available: New Conditional Instructions (NCI), New Data
Destination (NDD), and Flags Suppression (NF).

> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 990ad7ea48186..6c47e0ffedd84 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
[ ... ]
> @@ -1733,7 +1737,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
>  	}
>  	/* APX sub-features */
>  	case 0x29:
> -		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
> +		if (!kvm_cpu_cap_has(X86_FEATURE_APX))
> +			entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
>  		break;

[Severity: Medium]
Will this leak unmasked raw host CPUID state to the guest when APX is
available?

Since do_host_cpuid() populates the initial entry directly from the physical
CPU's output, it appears this case completes without calling
cpuid_entry_override(entry, CPUID_29_0_EBX) to apply the capability mask.

Does omitting the override mean KVM passes the raw host CPUID 0x29:0 directly
to the guest, including eax, ecx, edx, and any unsupported ebx bits?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902021804.718676-1-chang.seok.bae@intel.com?part=18