Re: [PATCH v8 18/20] KVM: x86: Expose APX sub-features to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] kvm: x86: Missing cpuid_entry_override for leaf 0x29 exposes unmasked host features
--

commit 93c8fb6f09423dcd87349e9f19f305fc82d6113e
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Expose APX sub-features to userspace

This commit adds CPUID leaf 0x29 sub-leaf 0 to expose APX sub-features
(New Conditional Instructions, New Data Destination, Flags Suppression)
to userspace if the APX foundation is available.

> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 990ad7ea48186..6c47e0ffedd84 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -1733,7 +1737,8 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function)
>  	}
>  	/* APX sub-features */
>  	case 0x29:
> -		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
> +		if (!kvm_cpu_cap_has(X86_FEATURE_APX))
> +			entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
>  		break;

[Severity: Medium]
Does this code leak unfiltered host CPUID capabilities for leaf 0x29 to the
guest?

If the host supports X86_FEATURE_APX, KVM fails to apply
cpuid_entry_override(entry, CPUID_29_0_EBX) or explicitly clear the
unvirtualized registers (eax, ecx, edx) for leaf 0x29 in __do_cpuid_func().

This could bypass the capability mask initialized in
kvm_initialize_cpu_caps(), violating the KVM invariant that new
guest-visible features must default off and be explicitly enumerated.
This might break capability negotiation and live migration between hosts
with varying hardware support.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930210750.1487547-1-chang.seok.bae@intel.com?part=18