Re: [RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Binbin Wu <binbin.wu@linux.intel.com>]

On 5/15/2026 5:03 PM, Xiaoyao Li wrote:
> On 4/17/2026 3:35 PM, Binbin Wu wrote:
>> Guard the use of cpuid_func_emulated() with a check that the CPUID
>> sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
>> emulated features for index 0 and does not account for indexed leaves.
>>
>> Without the guard, when iterating over reverse_cpuid[] entries that
>> share the same CPUID function but have a non-zero index, e.g.
>> CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
>> are incorrectly OR'd into the wrong capability word.  For example,
>> RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
>> which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
>> capabilities.
>>
>> This is currently benign as the affected bits in the non-zero index
>> words happen to not correspond to meaningful features, but it could
>> cause problems as new features are defined in those positions.
>>
>> Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
>> ---
>>   arch/x86/kvm/cpuid.c | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
>> index e69156b54cff..25f582a8d795 100644
>> --- a/arch/x86/kvm/cpuid.c
>> +++ b/arch/x86/kvm/cpuid.c
>> @@ -399,15 +399,16 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>>           if (!entry)
>>               continue;
>>   -        cpuid_func_emulated(&emulated, cpuid.function, true);
>> -
>>           /*
>>            * A vCPU has a feature if it's supported by KVM and is enabled
>>            * in guest CPUID.  Note, this includes features that are
>>            * supported by KVM but aren't advertised to userspace!
>>            */
>> -        vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i] |
>> -                     cpuid_get_reg_unsafe(&emulated, cpuid.reg);
>> +        vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i];
>> +        if (!cpuid.index) {
> 
> Instead of such a temporary fix, I would prefer adding the index parameter to cpuid_func_emulated() and split this patch separately.

I did it in this way because:
- The index parameter was here and it was removed in commit ab8bcf649711
- I thought cpuid_func_emulated() probably would not be extended in the future.

> 
>> +            cpuid_func_emulated(&emulated, cpuid.function, true);
>> +            vcpu->arch.cpu_caps[i] |= cpuid_get_reg_unsafe(&emulated, cpuid.reg);
>> +        }
>>           vcpu->arch.cpu_caps[i] &= cpuid_get_reg_unsafe(entry, cpuid.reg);
>>       }
>>   
>