Re: [PATCH v5 18/20] KVM: x86: Expose APX sub-features to userspace

["Chang S. Bae" <chang.seok.bae@intel.com>]

On 7/20/2026 11:10 AM, sashiko-bot@kernel.org wrote:
>>   	/* APX sub-features */
>>   	case 0x29:
>> -		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
>> +		if (!kvm_cpu_cap_has(X86_FEATURE_APX))
>> +			entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
>>   		break;
> 
> [Severity: High]
> If kvm_cpu_cap_has(X86_FEATURE_APX) is true, does this bypass capability
> filtering and expose raw host CPUID values for leaf 0x29?
> 
> Looking at other leaves in __do_cpuid_func(), they typically use
> cpuid_entry_override() or manually clear unused registers to apply the KVM
> masks. Without this masking, it appears a userspace VMM querying
> KVM_GET_SUPPORTED_CPUID for leaf 0x29 will receive unvirtualized hardware
> features, which could then leak into the guest.

Without -mapxf (or -march=native on APX machines [*]), the compiler 
shouldn't have no EGPRs in the optimization options I think.

[*] the fix is work-in-progress right now

> [Severity: Medium]
> Does cpuid_function_is_indexed() in arch/x86/include/asm/cpuid/api.h also
> need to be updated to include 0x29?
Commented on patch17

Thanks,
Chang