Re: [RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Sean Christopherson <seanjc@google.com>]

On Tue, Jun 09, 2026, Binbin Wu wrote:
> On 6/8/2026 10:19 PM, Sean Christopherson wrote:
> > On Mon, Jun 08, 2026, Binbin Wu wrote:
> >>
> >>
> >> On 4/17/2026 3:35 PM, Binbin Wu wrote:
> >>> Guard the use of cpuid_func_emulated() with a check that the CPUID
> >>> sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
> >>> emulated features for index 0 and does not account for indexed leaves.
> >>>
> >>> Without the guard, when iterating over reverse_cpuid[] entries that
> >>> share the same CPUID function but have a non-zero index, e.g.
> >>> CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
> >>> are incorrectly OR'd into the wrong capability word.  For example,
> >>> RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
> >>> which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
> >>> capabilities.
> >>>
> >>> This is currently benign as the affected bits in the non-zero index
> >>> words happen to not correspond to meaningful features, but it could
> >>> cause problems as new features are defined in those positions.
> >>>
> >>
> >> Hi Sean/Paolo,
> >>
> >> While the bug is currently benign, I still think it's worth fixing.
> >>
> >> There could be two options:
> >> - Considering cpuid_func_emulated() probably would not be extended
> >>   in the future, still keep this simple implementation, but add some
> >>   comments to cpuid_func_emulated() to call out only subleaf 0 is emulated
> >>   as suggested by Xiaoyao.
> >>   https://lore.kernel.org/kvm/fa47d520-1de9-4ddc-94ca-6bb53ac30f10@intel.com/
> >> - Add the index input parameter to cpuid_func_emulated().
> > 
> > Definitely handle this in cpuid_func_emulated().
> 
> Thanks, the diff looks good to me.
> I will send a separate patch for this.
> 
> BTW, do you want to provide your SOB?

Nah, you did the hard part, claim it as your own.