Re: [RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Binbin Wu <binbin.wu@linux.intel.com>]

On 6/8/2026 10:19 PM, Sean Christopherson wrote:
> On Mon, Jun 08, 2026, Binbin Wu wrote:
>>
>>
>> On 4/17/2026 3:35 PM, Binbin Wu wrote:
>>> Guard the use of cpuid_func_emulated() with a check that the CPUID
>>> sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
>>> emulated features for index 0 and does not account for indexed leaves.
>>>
>>> Without the guard, when iterating over reverse_cpuid[] entries that
>>> share the same CPUID function but have a non-zero index, e.g.
>>> CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
>>> are incorrectly OR'd into the wrong capability word.  For example,
>>> RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
>>> which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
>>> capabilities.
>>>
>>> This is currently benign as the affected bits in the non-zero index
>>> words happen to not correspond to meaningful features, but it could
>>> cause problems as new features are defined in those positions.
>>>
>>
>> Hi Sean/Paolo,
>>
>> While the bug is currently benign, I still think it's worth fixing.
>>
>> There could be two options:
>> - Considering cpuid_func_emulated() probably would not be extended
>>   in the future, still keep this simple implementation, but add some
>>   comments to cpuid_func_emulated() to call out only subleaf 0 is emulated
>>   as suggested by Xiaoyao.
>>   https://lore.kernel.org/kvm/fa47d520-1de9-4ddc-94ca-6bb53ac30f10@intel.com/
>> - Add the index input parameter to cpuid_func_emulated().
> 
> Definitely handle this in cpuid_func_emulated().

Thanks, the diff looks good to me.
I will send a separate patch for this.

BTW, do you want to provide your SOB?

> 
> diff --git arch/x86/kvm/cpuid.c arch/x86/kvm/cpuid.c
> index db8be9173bd0..737ca3e7bda2 100644
> --- arch/x86/kvm/cpuid.c
> +++ arch/x86/kvm/cpuid.c
> @@ -400,7 +400,7 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>                 if (!entry)
>                         continue;
>  
> -               cpuid_func_emulated(&emulated, cpuid.function, true);
> +               cpuid_func_emulated(&emulated, cpuid.function, cpuid.index, true);
>  
>                 /*
>                  * A vCPU has a feature if it's supported by KVM and is enabled
> @@ -1369,11 +1369,15 @@ static struct kvm_cpuid_entry2 *do_host_cpuid(struct kvm_cpuid_array *array,
>         return entry;
>  }
>  
> -static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func,
> +static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, u32 index,
>                                bool include_partially_emulated)
>  {
>         memset(entry, 0, sizeof(*entry));
>  
> +       /* KVM doesn't currently emulate any non-zero indices. */
> +       if (cpuid_function_is_indexed(func) && index)
> +               return 0;
> +
>         entry->function = func;
>         entry->index = 0;
>         entry->flags = 0;
> @@ -1411,7 +1415,7 @@ static int __do_cpuid_func_emulated(struct kvm_cpuid_array *array, u32 func)
>         if (array->nent >= array->maxnent)
>                 return -E2BIG;
>  
> -       array->nent += cpuid_func_emulated(&array->entries[array->nent], func, false);
> +       array->nent += cpuid_func_emulated(&array->entries[array->nent], func, 0, false);
>         return 0;
>  }
>  
> 
>