Re: [RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Sean Christopherson <seanjc@google.com>]

On Mon, Jun 08, 2026, Binbin Wu wrote:
> 
> 
> On 4/17/2026 3:35 PM, Binbin Wu wrote:
> > Guard the use of cpuid_func_emulated() with a check that the CPUID
> > sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
> > emulated features for index 0 and does not account for indexed leaves.
> > 
> > Without the guard, when iterating over reverse_cpuid[] entries that
> > share the same CPUID function but have a non-zero index, e.g.
> > CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
> > are incorrectly OR'd into the wrong capability word.  For example,
> > RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
> > which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
> > capabilities.
> > 
> > This is currently benign as the affected bits in the non-zero index
> > words happen to not correspond to meaningful features, but it could
> > cause problems as new features are defined in those positions.
> > 
> 
> Hi Sean/Paolo,
> 
> While the bug is currently benign, I still think it's worth fixing.
> 
> There could be two options:
> - Considering cpuid_func_emulated() probably would not be extended
>   in the future, still keep this simple implementation, but add some
>   comments to cpuid_func_emulated() to call out only subleaf 0 is emulated
>   as suggested by Xiaoyao.
>   https://lore.kernel.org/kvm/fa47d520-1de9-4ddc-94ca-6bb53ac30f10@intel.com/
> - Add the index input parameter to cpuid_func_emulated().

Definitely handle this in cpuid_func_emulated().

diff --git arch/x86/kvm/cpuid.c arch/x86/kvm/cpuid.c
index db8be9173bd0..737ca3e7bda2 100644
--- arch/x86/kvm/cpuid.c
+++ arch/x86/kvm/cpuid.c
@@ -400,7 +400,7 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
                if (!entry)
                        continue;
 
-               cpuid_func_emulated(&emulated, cpuid.function, true);
+               cpuid_func_emulated(&emulated, cpuid.function, cpuid.index, true);
 
                /*
                 * A vCPU has a feature if it's supported by KVM and is enabled
@@ -1369,11 +1369,15 @@ static struct kvm_cpuid_entry2 *do_host_cpuid(struct kvm_cpuid_array *array,
        return entry;
 }
 
-static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func,
+static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, u32 index,
                               bool include_partially_emulated)
 {
        memset(entry, 0, sizeof(*entry));
 
+       /* KVM doesn't currently emulate any non-zero indices. */
+       if (cpuid_function_is_indexed(func) && index)
+               return 0;
+
        entry->function = func;
        entry->index = 0;
        entry->flags = 0;
@@ -1411,7 +1415,7 @@ static int __do_cpuid_func_emulated(struct kvm_cpuid_array *array, u32 func)
        if (array->nent >= array->maxnent)
                return -E2BIG;
 
-       array->nent += cpuid_func_emulated(&array->entries[array->nent], func, false);
+       array->nent += cpuid_func_emulated(&array->entries[array->nent], func, 0, false);
        return 0;
 }